Lucene search

MitreCVE-2013-7172

HistoryNov 21, 2019 - 2:15 p.m.

CVE-2013-7172

2019-11-2114:15:12

CWE-20

mitre

web.nvd.nist.gov

cve-2013-7172

slackware

libiodbc

world-writable permission

vulnerability

nvd

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

Percentile

5.1%

JSON

Slackware 13.1, 13.37, 14.0 and 14.1 contain world-writable permissions on the iodbctest and iodbctestw programs within the libiodbc package, which could allow local users to use RPATH information to execute arbitrary code with root privileges.

Affected configurations

Nvd

Node

slackwareslackware_linuxMatch13.1

slackwareslackware_linuxMatch13.37

slackwareslackware_linuxMatch14.0

slackwareslackware_linuxMatch14.1

VendorProductVersionCPE
slackwareslackware_linux13.1cpe:2.3:o:slackware:slackware_linux:13.1:*:*:*:*:*:*:*
slackwareslackware_linux13.37cpe:2.3:o:slackware:slackware_linux:13.37:*:*:*:*:*:*:*
slackwareslackware_linux14.0cpe:2.3:o:slackware:slackware_linux:14.0:*:*:*:*:*:*:*
slackwareslackware_linux14.1cpe:2.3:o:slackware:slackware_linux:14.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
slackware	slackware_linux	13.1	cpe:2.3:o:slackware:slackware_linux:13.1:::::::*
slackware	slackware_linux	13.37	cpe:2.3:o:slackware:slackware_linux:13.37:::::::*
slackware	slackware_linux	14.0	cpe:2.3:o:slackware:slackware_linux:14.0:::::::*
slackware	slackware_linux	14.1	cpe:2.3:o:slackware:slackware_linux:14.1:::::::*

References

www.openwall.com/lists/oss-security/2013/12/20/1

bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-7172

exchange.xforce.ibmcloud.com/vulnerabilities/89916

security-tracker.debian.org/tracker/CVE-2013-7172

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2013-7172