CVE-2019-3467

Опубликовано: 23 дек. 2019

Источник: nvd

CVSS3: 7.8

CVSS2: 7.2

EPSS Низкий

Описание

Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.26, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other Kerberos user principals.

Ссылки

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=946797
Exploit
Mailing List
Patch
Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=947459
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/12/msg00023.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00012.html
Mailing List
Third Party Advisory
https://seclists.org/bugtraq/2019/Dec/34
Mailing List
Third Party Advisory
https://seclists.org/bugtraq/2019/Dec/44
Mailing List
Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2019-3467
Third Party Advisory
https://usn.ubuntu.com/4530-1/
Third Party Advisory
https://www.debian.org/security/2019/dsa-4589
Third Party Advisory
https://www.debian.org/security/2019/dsa-4595
Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=946797
Exploit
Mailing List
Patch
Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=947459
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/12/msg00023.html
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/01/msg00012.html
Mailing List
Third Party Advisory
https://seclists.org/bugtraq/2019/Dec/34
Mailing List
Third Party Advisory
https://seclists.org/bugtraq/2019/Dec/44
Mailing List
Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2019-3467
Third Party Advisory
https://usn.ubuntu.com/4530-1/
Third Party Advisory
https://www.debian.org/security/2019/dsa-4589
Third Party Advisory
https://www.debian.org/security/2019/dsa-4595
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:debian:debian-lan-config:*:*:*:*:*:*:*:*

Версия до 0.26 (исключая)

cpe:2.3:a:skolelinux:debian-edu-config:*:*:*:*:*:*:*:*

Версия до 2.11.10 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

EPSS

Процентиль: 25%

0.00085

Низкий

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-732

Связанные уязвимости

CVE-2019-3467

CVSS3: 7.8

ubuntu

около 6 лет назад

CVE-2019-3467

CVSS3: 7.8

debian

около 6 лет назад

Debian-edu-config all versions < 2.11.10, a set of configuration files ...

GHSA-qwf4-gh23-f5jj

CVSS3: 7.8

github

больше 3 лет назад

Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other Kerberos user principals.

BDU:2020-01977

CVSS3: 7.8

fstec

около 6 лет назад

Уязвимость множества элементов дистрибутива Debian-edu, связанная с недостатком в безопасности управления привилегиями, позволяющая нарушителю получить несанкционированный доступ к конфиденциальным данным, вызвать отказ в обслуживании и оказать воздействие на целостность данных

EPSS

Процентиль: 25%

0.00085

Низкий

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-732