CVE-2015-3171
Published: 25 July 2017
sosreport 3.2 uses weak permissions for generated sosreport archives, which allows local users with access to /var/tmp/ to obtain sensitive information by reading the contents of the archive.
Notes
Author | Note |
---|---|
mdeslaur | introduced by 8d2577786cce6fcc915836108e405dbf5025dec8 |
Priority
Status
Package | Release | Status |
---|---|---|
sosreport Launchpad, Ubuntu, Debian |
precise |
Does not exist
|
trusty |
Not vulnerable
(3.1-1ubuntu2.1)
|
|
upstream |
Released
(3.2-2)
|
|
utopic |
Not vulnerable
(3.1-1ubuntu3)
|
|
vivid |
Not vulnerable
(3.2-2)
|
|
Patches: upstream: https://github.com/sosreport/sos/commit/d7759d3ddae5fe99a340c88a1d370d65cfa73fd6 |
Severity score breakdown
Parameter | Value |
---|---|
Base score | 5.5 |
Attack vector | Local |
Attack complexity | Low |
Privileges required | Low |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | None |
Availability impact | None |
Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |