Veracode Vulnerability DatabaseVERACODE:23262Privilege Escalation
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N
e2fsprogs is vulnerable to privilege escalation. The vulnerability exists when a victim opens a carefully crafted file system with a program using e2fsprogs, it may be possible to execute arbitrary code with the permissions of the victim. It may be possible to leverage this flaw in a virtualized environment to gain access to other virtualized hosts.
| CPE | Name | Operator | Version |
|---|---|---|---|
| e2fsprogs | eq | 1.35__12.5.el4 | |
| e2fsprogs | eq | 1.39__8.el5 | |
| e2fsprogs | eq | 1.35__12.5.el4 | |
| e2fsprogs | eq | 1.39__8.el5 |
References
itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083
lists.vmware.com/pipermail/security-announce/2008/000007.html
secunia.com/advisories/27889
secunia.com/advisories/27965
secunia.com/advisories/27987
secunia.com/advisories/28000
secunia.com/advisories/28030
secunia.com/advisories/28042
secunia.com/advisories/28360
secunia.com/advisories/28541
secunia.com/advisories/28648
secunia.com/advisories/29224
secunia.com/advisories/32774
secunia.com/advisories/40551
sourceforge.net/project/shownotes.php?release_id=560230&group_id=2406
support.avaya.com/elmodocs2/security/ASA-2008-040.htm
support.citrix.com/article/CTX118766
wiki.rpath.com/Advisories:rPSA-2007-0262
www.debian.org/security/2007/dsa-1422
www.mandriva.com/security/advisories?name=MDKSA-2007:242
www.novell.com/linux/security/advisories/2007_25_sr.html
www.redhat.com/security/updates/classification/#moderate
www.redhat.com/support/errata/RHSA-2008-0003.html
www.securityfocus.com/archive/1/487999/100/0/threaded
www.securityfocus.com/archive/1/489082/100/0/threaded
www.securityfocus.com/bid/26772
www.securitytracker.com/id?1019537
www.ubuntu.com/usn/usn-555-1
www.vmware.com/security/advisories/VMSA-2008-0004.html
www.vupen.com/english/advisories/2007/4135
www.vupen.com/english/advisories/2008/0761
www.vupen.com/english/advisories/2010/1796
access.redhat.com/errata/RHSA-2008:0003
access.redhat.com/security/cve/CVE-2007-5497
bugzilla.redhat.com/show_bug.cgi?id=403441
exchange.xforce.ibmcloud.com/vulnerabilities/38903
issues.rpath.com/browse/RPL-2011
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10399
www.redhat.com/archives/fedora-package-announce/2008-January/msg00618.html
www.redhat.com/archives/fedora-package-announce/2008-January/msg00629.html
Related
5.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:P/A:N