CVE-2010-4176

Published: Dec 7, 2010Modified: Apr 29, 2026

4.0

Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability: 8.0 / Impact: 2.9

Source: NVD

Description

plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.

Affected (2)

Products: Dracut Project: Dracut · Udev Project: Udev

1 product

1 product

Configuration A

2 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Dracut Project Dracut	All versions
Udev Project Udev	All versions

Running on/with	Platform Versions
Fedoraproject Fedora	Version 13
Fedoraproject Fedora	Version 14

Related CWEs

CWE-276

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

References (18)

http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051755.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051418.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://secunia.com/advisories/42342

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/42451

Source: secalert@redhat.com

Not Applicable

http://www.securityfocus.com/bid/45046

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.vupen.com/english/advisories/2010/3062

Source: secalert@redhat.com

Permissions Required

http://www.vupen.com/english/advisories/2010/3110

Source: secalert@redhat.com

Permissions Required

https://bugzilla.redhat.com/show_bug.cgi?id=654489

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=654935

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051755.html