NVD Vulnerability Detail

CVE-2011-2490

Summary	opielogin.c in opielogin in OPIE 2.4.1-test1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by arranging for an account to already be running its maximum number of processes.
Publication Date	July 27, 2011, 11:55 a.m.
Registration Date	Jan. 28, 2021, 4:38 p.m.
Last Update	Nov. 21, 2024, 10:28 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631345	Patch
2	http://secunia.com/advisories/39966	Vendor Advisory
3	http://secunia.com/advisories/45136	Vendor Advisory
4	http://secunia.com/advisories/45448
5	http://www.debian.org/security/2011/dsa-2281
6	http://www.openwall.com/lists/oss-security/2011/06/22/6	Exploit Patch
7	http://www.openwall.com/lists/oss-security/2011/06/23/5	Exploit Patch
8	http://www.securityfocus.com/bid/48390
9	https://bugzilla.novell.com/show_bug.cgi?id=698772	Exploit Patch
10	https://bugzillafiles.novell.org/attachment.cgi?id=435901	Patch
11	https://hermes.opensuse.org/messages/10082052
12	https://hermes.opensuse.org/messages/10082068
13	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631345	Patch
14	https://hermes.opensuse.org/messages/10082068
15	https://hermes.opensuse.org/messages/10082052
16	https://bugzillafiles.novell.org/attachment.cgi?id=435901	Patch
17	https://bugzilla.novell.com/show_bug.cgi?id=698772	Exploit Patch
18	http://www.securityfocus.com/bid/48390
19	http://www.openwall.com/lists/oss-security/2011/06/23/5	Exploit Patch
20	http://www.openwall.com/lists/oss-security/2011/06/22/6	Exploit Patch
21	http://www.debian.org/security/2011/dsa-2281
22	http://secunia.com/advisories/45448
23	http://secunia.com/advisories/45136	Vendor Advisory
24	http://secunia.com/advisories/39966	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

JVN Vulnerability Information

OPIE の opielogin.c における権限を取得される脆弱性

Title	OPIE の opielogin.c における権限を取得される脆弱性
Summary	OPIE の opielogin の opielogin.c は、setuid システム呼び出しの返り値をチェックしないため、権限を取得される脆弱性が存在します。
Possible impacts	ローカルユーザにより、最大数のプロセス実行するためのアカウントを配置されることで、権限を取得される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	July 26, 2011, midnight
Registration Date	March 27, 2012, 6:43 p.m.
Last Update	March 27, 2012, 6:43 p.m.

Affected System

NRL

opie 2.4.1-test1 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-2490	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2490
National Vulnerability Database (NVD)
2	CVE-2011-2490	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-2490

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
U.S. Naval Research Laboratory
1	OPIE	https://addons.mozilla.org/ja/firefox/addon/opie/

Change Log

No	Changed Details	Date of change
0	[2012年03月27日] 掲載	Feb. 17, 2018, 10:37 a.m.