Lucene search

RedhatCVE-2016-6299

HistoryApr 14, 2017 - 6:59 p.m.

CVE-2016-6299

2017-04-1418:59:00

CWE-264

redhat

web.nvd.nist.gov

cve-2016-6299

scm plug-in

mock

chroot protection

root privileges

crafted spec file

nvd

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.002

Percentile

51.7%

JSON

The scm plug-in in mock might allow attackers to bypass the intended chroot protection mechanism and gain root privileges via a crafted spec file.

Affected configurations

Nvd

Node

fedoraprojectfedoraMatch23

fedoraprojectfedoraMatch24

fedoraprojectfedoraMatch25

Node

mock_projectscm_pluginMatch-mock

VendorProductVersionCPE
fedoraprojectfedora23cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*
fedoraprojectfedora24cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*
fedoraprojectfedora25cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*
mock_projectscm_plugin-cpe:2.3:a:mock_project:scm_plugin:-:*:*:*:*:mock:*:*

Vendor	Product	Version	CPE
fedoraproject	fedora	23	cpe:2.3:o:fedoraproject:fedora:23:::::::*
fedoraproject	fedora	24	cpe:2.3:o:fedoraproject:fedora:24:::::::*
fedoraproject	fedora	25	cpe:2.3:o:fedoraproject:fedora:25:::::::*
mock_project	scm_plugin	-	cpe:2.3:a:mock_project:scm_plugin:-:::::mock::

References

www.openwall.com/lists/oss-security/2016/09/13/2

www.securityfocus.com/bid/92948

bugzilla.redhat.com/show_bug.cgi?id=1375490

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFC4LU6GYYEVUK6LQ2FKUGMZXRTLLL5A/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VYLMPA5VLLX67DUJ6XLJ2TIW6CX2CFL4/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5PH2YGYWYUAYPHK32SGUZGZXQEBEYNK/

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.002

Percentile

51.7%

JSON

Related for CVE-2016-6299