Lucene search
Gentoo FoundationGLSA-201412-45HistoryDec 26, 2014 - 12:00 a.m.
Facter: Privilege escalation
2014-12-2600:00:00
Gentoo Foundation
security.gentoo.org
31
CVSS2
6.2
Attack Vector
LOCAL
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:H/Au:N/C:C/I:C/A:C
EPSS
0
Percentile
5.1%
Background
Facter is a cross-platform Ruby library for retrieving facts from operating systems.
Description
Facter includes the current working directory in the search path.
Impact
A local attacker may be able to gain escalated privileges.
Workaround
There is no known workaround at this time.
Resolution
All Facter users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-ruby/facter-1.7.6"
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Gentoo | any | all | dev-ruby/facter | < 1.7.6 | UNKNOWN |
Related
amazon
amazon
Medium: puppet
2015-02-12 15:13:00
Medium: facter
2014-12-08 13:12:00
openvas
openvas
Amazon Linux: Security Advisory (ALAS-2014-456)
2015-09-08 00:00:00
Amazon Linux: Security Advisory (ALAS-2015-484)
2015-09-08 00:00:00
Fedora Update for facter FEDORA-2014-12699
2014-11-23 00:00:00
nessus
nessus
Fedora 20 : facter-1.7.6-1.fc20 (2014-12699)
2014-11-24 00:00:00
GLSA-201412-45 : Facter: Privilege escalation
2014-12-29 00:00:00
Amazon Linux AMI : puppet (ALAS-2015-484)
2015-02-13 00:00:00
rubygems
rubygems
ubuntucve
ubuntucve
CVE-2014-3248
2014-11-16 00:00:00
fedora
fedora
[SECURITY] Fedora 20 Update: facter-1.7.6-1.fc20
2014-11-22 12:33:35
osv
osv
facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability
2017-10-24 18:33:36
ruby2.2-rubygem-facter-2.4.6-2.1 on GA media
2024-06-15 00:00:00
cve
cve
CVE-2014-3248
2014-11-16 17:59:03
debiancve
debiancve
CVE-2014-3248
2014-11-16 17:59:03
github
github
prion
prion
Design/Logic Flaw
2014-11-16 17:59:00
cvelist
cvelist
CVE-2014-3248
2014-11-16 17:00:00
nvd
nvd
CVE-2014-3248
2014-11-16 17:59:03
gentoo
gentoo
MCollective: Privilege escalation
2014-12-13 00:00:00
ubuntu
ubuntu
Puppet vulnerabilities
2017-06-05 00:00:00
CVSS2
6.2
Attack Vector
LOCAL
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:H/Au:N/C:C/I:C/A:C
EPSS
0
Percentile
5.1%
Related for GLSA-201412-45