CVE-2019-10143
It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has cont...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of the radiusd user to escalate his privileges to root, by tricking logrotate into writing a radiusd-writable file to a directory normally inaccessible by the radiusd user. NOTE: the upstream software maintainer has stated "there is simply no way for anyone to gain privileges through this alleged issue."
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2019-10143 freeradius Corrigé dans: 3.0.19-r3
- Debian DEBIAN-CVE-2019-10143 freeradius
- Ubuntu UBUNTU-CVE-2019-10143 freeradius
Références
- advisory access.redhat.com
- advisory freeradius.org
- advisory github.com
- report bugzilla.redhat.com
- report packetstormsecurity.com
- report seclists.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org