CVE Vulnerabilities

CVE-2011-2910

Improper Privilege Management

Published: Nov 15, 2019 | Modified: Nov 26, 2019
CVSS 3.x
6.7
MEDIUM
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
7.2 HIGH
AV:L/AC:L/Au:N/C:C/I:C/A:C
RedHat/V2
RedHat/V3
Ubuntu
LOW

The AX.25 daemon (ax25d) in ax25-tools before 0.0.8-13 does not check the return value of a setuid call. The setuid call is responsible for dropping privileges but if the call fails the daemon would continue to run with root privileges which can allow possible privilege escalation.

Weakness

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected Software

Name Vendor Start Version End Version
Ax25-tools Linux-ax25 * 0.0.8-13 (excluding)
Ax25-tools Ubuntu hardy *
Ax25-tools Ubuntu lucid *
Ax25-tools Ubuntu maverick *
Ax25-tools Ubuntu natty *
Ax25-tools Ubuntu oneiric *
Ax25-tools Ubuntu upstream *

Potential Mitigations

References