CVE-2013-1068

The OpenStack Nova (python-nova) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.2 and 1:2014.1-0 before 1:2014.1-0ubuntu1.2 and Openstack Cinder (python-cinder) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.1 and 1:2014.1-0 before 1:2014.1-0ubuntu1.1 for Ubuntu 13.10 and 14.04 LTS does not properly set the sudo configuration, which makes it easier for attackers to gain privileges by leveraging another vulnerability.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://ubuntu.com/usn/usn-2248-1	Patch Vendor Advisory
http://www.ubuntu.com/usn/USN-2247-1	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:13.10:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::

History

No history.

Information

Published : 2014-06-19 15:55

Updated : 2014-06-20 17:57

NVD link : CVE-2013-1068

Mitre link : CVE-2013-1068

CVE.ORG link : CVE-2013-1068

JSON object : View

Products Affected

canonical

ubuntu_linux

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2013-1068", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-06-19T15:55:06.387", "references": [{"url": "http://ubuntu.com/usn/usn-2248-1", "tags": ["Patch", "Vendor Advisory"], "source": "security@ubuntu.com"}, {"url": "http://www.ubuntu.com/usn/USN-2247-1", "tags": ["Patch", "Vendor Advisory"], "source": "security@ubuntu.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The OpenStack Nova (python-nova) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.2 and 1:2014.1-0 before 1:2014.1-0ubuntu1.2 and Openstack Cinder (python-cinder) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.1 and 1:2014.1-0 before 1:2014.1-0ubuntu1.1 for Ubuntu 13.10 and 14.04 LTS does not properly set the sudo configuration, which makes it easier for attackers to gain privileges by leveraging another vulnerability."}, {"lang": "es", "value": "Los paquetes OpenStack Nova (python-nova) 1:2013.2.3-0 anterior a 1:2013.2.3-0ubuntu1.2 y 1:2014.1-0 anterior a 1:2014.1-0ubuntu1.2 y Openstack Cinder (python-cinder) 1:2013.2.3-0 anterior a 1:2013.2.3-0ubuntu1.1 y 1:2014.1-0 anterior a 1:2014.1-0ubuntu1.1 para Ubuntu 13.10 y 14.04 LTS no configura debidamente la configuraci\u00f3n sudo, lo que facilita a atacantes ganar privilegios mediante el aprovechamiento de otra vulnerabilidad."}], "lastModified": "2014-06-20T17:57:50.643", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F61F047-129C-41A6-8A27-FFCBB8563E91"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}