Multiple vulnerabilities in Cloud Foundry Foundation cflinuxfs3

Published: 2022-11-28

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2013-4235 CVE-2017-2626
CWE-ID	CWE-367 CWE-331
Exploitation vector	Local
Public exploit	N/A
Vulnerable software Subscribe	cflinuxfs3 Other software / Other software solutions
Vendor	Cloud Foundry Foundation

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Time-of-check Time-of-use (TOCTOU) Race Condition

EUVDB-ID: #VU59131

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2013-4235

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Exploit availability: No

Description

The vulnerability allows a local user to delete or modify arbitrary files on the system.

The vulnerability exists due to a race condition in shadow-utils when executing usermod/userdel operations. A local user with write access to the directory that is being moved or deleted by the usermod/userdel commands can modify or delete arbitrary files on the system.

Successful exploitation of the vulnerability may allow an attacker to corrupt arbitrary files on the system and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

cflinuxfs3: before 0.341.0

CPE2.3

External links

http://github.com/cloudfoundry/cflinuxfs3/releases/tag/0.341.0

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Insufficient Entropy

EUVDB-ID: #VU32017