CVE-2014-3209 The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain the private key by reading the file.
LowCVSS 2.1
EPSS 0.38%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain the private key by reading the file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/ldns(Debian:12) | < 1.6.17-4 | 1.6.17-4 |
| debian/ldns(Debian:13) | < 1.6.17-4 | 1.6.17-4 |
| debian/ldns(Debian:14) | < 1.6.17-4 | 1.6.17-4 |
| nlnetlabs ldns | = 1.6.0 | No fix listed |
| nlnetlabs ldns | = 1.6.1 | No fix listed |
| nlnetlabs ldns | = 1.6.2 | No fix listed |
| nlnetlabs ldns | = 1.6.3 | No fix listed |
| nlnetlabs ldns | = 1.6.4 | No fix listed |
| nlnetlabs ldns | = 1.6.5 | No fix listed |
| nlnetlabs ldns | = 1.6.6 | No fix listed |
| nlnetlabs ldns | = 1.6.7 | No fix listed |
| nlnetlabs ldns | = 1.6.8 | No fix listed |
| nlnetlabs ldns | = 1.6.9 | No fix listed |
| nlnetlabs ldns | = 1.6.10 | No fix listed |
| nlnetlabs ldns | = 1.6.11 | No fix listed |
References
- Debian Security Tracker CVE-2014-3209 vendor-advisory
- [oss-security] 20140503 ldns-keygen creates private key world readable mailing-list
- [oss-security] 20140504 Re: ldns-keygen creates private key world readable mailing-list
- 67200 vdb-entry
- bugs.debian.org
- www.nlnetlabs.nl
- bugs.debian.org issue-tracking