CVE-2011-3349

lightdm before 0.9.6 writes in .dmrc and Xauthority files using root permissions while the files are in user controlled folders. A local user can overwrite root-owned files via a symlink, which can allow possible privilege escalation.

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://access.redhat.com/security/cve/cve-2011-3349	Broken Link
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=639151	Mailing List Third Party Advisory
https://bugs.launchpad.net/debian/+source/lightdm/+bug/834079	Third Party Advisory
https://seclists.org/oss-sec/2011/q3/393	Mailing List Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-3349	Third Party Advisory
https://www.securityfocus.com/bid/50506	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:lightdm_project:lightdm:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-11-19 22:15

Updated : 2023-12-10 13:13

NVD link : CVE-2011-3349

Mitre link : CVE-2011-3349

CVE.ORG link : CVE-2011-3349

JSON object : View

Products Affected

lightdm_project

lightdm

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2011-3349", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2019-11-19T22:15:11.007", "references": [{"url": "https://access.redhat.com/security/cve/cve-2011-3349", "tags": ["Broken Link"], "source": "secalert@redhat.com"}, {"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=639151", "tags": ["Mailing List", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugs.launchpad.net/debian/+source/lightdm/+bug/834079", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://seclists.org/oss-sec/2011/q3/393", "tags": ["Mailing List", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://security-tracker.debian.org/tracker/CVE-2011-3349", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://www.securityfocus.com/bid/50506", "tags": ["Third Party Advisory", "VDB Entry"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "lightdm before 0.9.6 writes in .dmrc and Xauthority files using root permissions while the files are in user controlled folders. A local user can overwrite root-owned files via a symlink, which can allow possible privilege escalation."}, {"lang": "es", "value": "lightdm versiones anteriores a 0.9.6 escribe en archivos .dmrc y Xauthority usando permisos de root mientras los archivos est\u00e1n en carpetas controladas por parte del usuario. Un usuario local puede sobrescribir los archivos de propiedad root por medio de un enlace simb\u00f3lico, lo que puede permitir una posible escalada de privilegios."}], "lastModified": "2019-12-03T16:19:59.420", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lightdm_project:lightdm:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F7CC168-BE90-4328-BA40-082A75258DE1", "versionEndExcluding": "0.9.6"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}