CVE-2010-0826 The Free Software Foundation (FSF) Berkeley DB NSS module (aka libnss-db) 2.2.3pre1 reads the DB_CONFIG file in the current working directory, which allows local users to obtain sensitive information....
LowCVSS 1.9
EPSS 0.37%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Free Software Foundation (FSF) Berkeley DB NSS module (aka libnss-db) 2.2.3pre1 reads the DB_CONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| piotr roszatycki libnss-db | = 2.2.3-pre1 | No fix listed |
| debian/libnss-db(Debian:12) | < 2.2.3pre1-3.2 | 2.2.3pre1-3.2 |
| debian/libnss-db(Debian:13) | < 2.2.3pre1-3.2 | 2.2.3pre1-3.2 |
References
- kb.juniper.net
- FEDORA-2010-6203 vendor-advisory
- 39165 third-party-advisory vendor-advisory
- MDVSA-2010:077 vendor-advisory
- 39132 vdb-entry
- USN-922-1 vendor-advisory
- ADV-2010-0776 vdb-entry vendor-advisory
- ADV-2010-0841 vdb-entry
- ADV-2010-0903 vdb-entry
- bugs.launchpad.net
- oval:org.mitre.oval:def:10727 signature vdb-entry
- oval:org.mitre.oval:def:6681 signature vdb-entry
- Debian Security Tracker CVE-2010-0826 vendor-advisory
- bugs.debian.org issue-tracking