CVE-2014-1422

Published: Jul 22, 2020Modified: Nov 21, 2024

5.0

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Exploitability: 1.3 / Impact: 3.6

Source: NVD

Description

In Ubuntu's trust-store, if a user revokes location access from an application, the location is still available to the application because the application will honour incorrect, cached permissions. This is because the cache was not ordered by creation time by the Select struct in src/core/trust/impl/sqlite3/store.cpp. Fixed in trust-store (Ubuntu) version 1.1.0+15.04.20150123-0ubuntu1 and trust-store (Ubuntu RTM) version 1.1.0+15.04.20150123~rtm-0ubuntu1.

Affected (2)

Products: Canonical: Trust Store (ubuntu), Trust Store (ubuntu Rtm)

2 products

Trust Store (ubuntu)

Trust Store (ubuntu Rtm)

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Canonical Trust Store (ubuntu)	Before 1.1.0
Canonical Trust Store (ubuntu Rtm)	Before 1.1.0

Related CWEs

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (4)

https://bazaar.launchpad.net/~phablet-team/trust-store/trunk/revision/82

Source: security@ubuntu.com

PatchThird Party Advisory

https://launchpad.net/bugs/1387734

Source: security@ubuntu.com

ExploitPatchThird Party Advisory

https://bazaar.launchpad.net/~phablet-team/trust-store/trunk/revision/82

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://launchpad.net/bugs/1387734

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchThird Party Advisory

Timeline

No history available yet.