CVE-2014-0470 super.c in Super 3.30.0 does not check the return value of the setuid function when the -F flag is set, which allows local users to gain privileges via unspecified vectors, aka an RLIMIT_NPROC attack.
HighCVSS 7.2
EPSS 0.37%
- Published
- Updated
- Exploit status
- No public exploit known
Description
super.c in Super 3.30.0 does not check the return value of the setuid function when the -F flag is set, which allows local users to gain privileges via unspecified vectors, aka an RLIMIT_NPROC attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/super(Debian:12) | < 3.30.0-7 | 3.30.0-7 |
| debian/super(Debian:13) | < 3.30.0-7 | 3.30.0-7 |
| debian/super(Debian:14) | < 3.30.0-7 | 3.30.0-7 |
| super project super | = 3.30.0 | No fix listed |
References
- Debian Security Tracker CVE-2014-0470 vendor-advisory
- DSA-2917 vendor-advisory
- [oss-security] 20140428 super unchecked setuid (CVE-2014-0470) mailing-list