ByteOS Network

NVD Vulnerability Details :

CVE-2017-18240

Analyzed

Source-cve@mitre.org

Published At-19 Mar, 2018 | 02:29

Updated At-18 Apr, 2018 | 16:14

The Gentoo app-admin/collectd package before 5.7.2-r1 sets the ownership of PID file directory to the collectd account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL (when the service is stopped).

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	5.5	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary	2.0	4.9	MEDIUM	AV:L/AC:L/Au:N/C:N/I:N/A:C

CPE Matches

collectd>>collectd>>Versions up to 5.7.2(inclusive)

cpe:2.3:a:collectd:collectd:*:*:*:*:*:*:*:*

collectd>>collectd>>5.7.2

cpe:2.3:a:collectd:collectd:5.7.2:r1:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-20	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.securityfocus.com/bid/103469	cve@mitre.org	Third Party Advisory VDB Entry
https://bugs.gentoo.org/628540	cve@mitre.org	Issue Tracking Vendor Advisory
https://security.gentoo.org/glsa/201803-10	cve@mitre.org	Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History