CVE-2008-1940
Severity CVSS v4.0:
Pending analysis
Type:
CWE-264
Permissions, Privileges, and Access Control
Publication date:
25/04/2008
Last modified:
08/08/2017
Description
The RBAC functionality in grsecurity before 2.1.11-2.6.24.5 and 2.1.11-2.4.36.2 does not enforce user_transition_deny and user_transition_allow rules for the (1) sys_setfsuid and (2) sys_setfsgid calls, which allows local users to bypass restrictions for those calls.
Impact
Base Score 2.0
4.60
Severity 2.0
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:grsecurity:grsecurity_kernel_patch:2.4.33:*:*:*:*:*:*:* | ||
| cpe:2.3:a:grsecurity:grsecurity_kernel_patch:2.4.33.2:*:*:*:*:*:*:* | ||
| cpe:2.3:a:grsecurity:grsecurity_kernel_patch:2.4.33.3:*:*:*:*:*:*:* | ||
| cpe:2.3:a:grsecurity:grsecurity_kernel_patch:2.4.33.4:*:*:*:*:*:*:* | ||
| cpe:2.3:a:grsecurity:grsecurity_kernel_patch:2.4.34:*:*:*:*:*:*:* | ||
| cpe:2.3:a:grsecurity:grsecurity_kernel_patch:2.6.18:*:*:*:*:*:*:* | ||
| cpe:2.3:a:grsecurity:grsecurity_kernel_patch:2.6.24.4:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page