Vulnerability Details : CVE-2009-1296
The eCryptfs support utilities (ecryptfs-utils) 73-0ubuntu6.1 on Ubuntu 9.04 stores the mount passphrase in installation logs, which might allow local users to obtain access to the filesystem by reading the log files from disk. NOTE: the log files are only readable by root.
Vulnerability category: Information leak
Products affected by CVE-2009-1296
- cpe:2.3:o:ubuntu:ubuntu:9.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:ubuntu:73-oubuntu:6.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2009-1296
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 6 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2009-1296
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
1.9
|
LOW | AV:L/AC:M/Au:N/C:P/I:N/A:N |
3.4
|
2.9
|
NIST |
CWE ids for CVE-2009-1296
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
Vendor statements for CVE-2009-1296
-
Red Hat 2009-06-10Not vulnerable. This issue did not affect the versions of ecryptfs-utils as shipped with Red Hat Enterprise Linux 5. eCryptfs encrypted home directories are not set up during the system installation, so theres no possibility for leaking encryption passwords to the installation log file.
References for CVE-2009-1296
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/51191
eCryptfs (ecryptfs-utils) passphrase information disclosure CVE-2009-1296 Vulnerability Report
-
http://www.ubuntu.com/usn/usn-783-1
USN-783-1: eCryptfs vulnerability | Ubuntu security notices | UbuntuVendor Advisory
-
http://www.securitytracker.com/id?1022347
Access Denied
Jump to