CVE-2004-2408 Linux VServer 1.27 and earlier, 1.3.9 and earlier, and 1.9.1 and earlier shares /proc permissions across all virtual and host servers, which allows local users with the ability to set permissions in /...
LowCVSS 3.6
EPSS 0.37%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Linux VServer 1.27 and earlier, 1.3.9 and earlier, and 1.9.1 and earlier shares /proc permissions across all virtual and host servers, which allows local users with the ability to set permissions in /proc to obtain system information or cause a denial of service on other virtual servers or the host server.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vserver linux-vserver | = 1.3.0 | No fix listed |
| vserver linux-vserver | = 1.3.1 | No fix listed |
| vserver linux-vserver | = 1.3.2 | No fix listed |
| vserver linux-vserver | = 1.3.3 | No fix listed |
| vserver linux-vserver | = 1.3.4 | No fix listed |
| vserver linux-vserver | = 1.3.5 | No fix listed |
| vserver linux-vserver | = 1.3.6 | No fix listed |
| vserver linux-vserver | = 1.3.7 | No fix listed |
| vserver linux-vserver | = 1.3.8 | No fix listed |
| vserver linux-vserver | = 1.3.9 | No fix listed |
| vserver linux-vserver | = 1.9.1 | No fix listed |
| vserver linux-vserver | = 1.20 | No fix listed |
| vserver linux-vserver | = 1.21 | No fix listed |
| vserver linux-vserver | = 1.22 | No fix listed |
| vserver linux-vserver | = 1.23 | No fix listed |
| vserver linux-vserver | = 1.24 | No fix listed |
| vserver linux-vserver | = 1.25 | No fix listed |
| vserver linux-vserver | = 1.26 | No fix listed |
| vserver linux-vserver | = 1.27 | No fix listed |
References
- 20040703 Linux Virtual Server/Secure Context procfs shared permissions flaw mailing-list vendor-advisory
- linux-vserver.org
- 12021 patch third-party-advisory vendor-advisory
- 1010643 vdb-entry vendor-advisory
- 7480 vdb-entry
- 10660 patch vdb-entry
- linux-vserver-modify-permissions(16626) vdb-entry