CVE-2011-3145

Published: Apr 22, 2019Modified: Nov 21, 2024

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

When mount.ecrpytfs_private before version 87-0ubuntu1.2 calls setreuid() it doesn't also set the effective group id. So when it creates the new version, mtab.tmp, it's created with the group id of the user running mount.ecryptfs_private.

Affected (1)

Products: Mount.ecrpytfs Private Project: Mount.ecrpytfs Private

Mount.ecrpytfs Private Project

1 product

Mount.ecrpytfs Private

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mount.ecrpytfs Private Project Mount.ecrpytfs Private	All versions

Related CWEs

CWE-254

References (2)

http://bazaar.launchpad.net/~ecryptfs/ecryptfs/trunk/revision/558

Source: cve@mitre.org

PatchThird Party Advisory

http://bazaar.launchpad.net/~ecryptfs/ecryptfs/trunk/revision/558

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.