An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon).
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Trousers | Trousers_project | * | 0.3.14 (including) |
| Red Hat Enterprise Linux 8 | RedHat | trousers-0:0.3.15-1.el8 | * |
| Trousers | Ubuntu | bionic | * |
| Trousers | Ubuntu | groovy | * |
| Trousers | Ubuntu | hirsute | * |
| Trousers | Ubuntu | impish | * |
| Trousers | Ubuntu | kinetic | * |
| Trousers | Ubuntu | trusty | * |
| Trousers | Ubuntu | xenial | * |