Yüksek CVSS 7.8 CISA KEV PoC var
CVE-2023-4911: Netapp Bootstrap OS: Güvenilmeyen Ortam Değişkeni ile Yetki Yükseltme Açığı
Netapp Bootstrap OS'taki bir kütüphane hatası, yerel bir saldırganın özel komutlar çalıştırmasına izin verir. Bu, sistemde yüksek yetki elde etmesine neden olabilir. Hemen Netapp'in güvenlik güncellemesini uygulayın.
Türkçe özet yapay zekâ ile üretildi.
Açıklama (NVD)
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.
Özet bilgiler
- Ürün
- Netapp Bootstrap Os
- CVSS v3.1
- 7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- %63,77 (yüzdelik 99)
- CWE
- CWE-122
- Yama
- Mevcut
- KEV
- Eklenme: 2023-11-21 · Son tarih: 2023-12-12
Gerekli aksiyon: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| netapp-bootstrap-os | — | — | — |
| siemens-simatic-s7-1500-cpu-1518-4-pn-dp-mfp-firmware | 3.1.5 | — | — |
| siemens-simatic-s7-1500-cpu-1518f-4-pn-dp-mfp-firmware | 3.1.5 | — | — |
| siemens-siplus-s7-1500-cpu-1518-4-pn-dp-mfp-firmware | 3.1.5 | — | — |
| siemens-simatic-s7-1500-tm-mfp-firmware | — | — | 1.1 |
| gnu-glibc | 2.34 | — | 2.39 |
| fedoraproject-fedora | 37 | 37 | — |
| fedoraproject-fedora | 38 | 38 | — |
| fedoraproject-fedora | 39 | 39 | — |
| redhat-codeready-linux-builder | 9.0 | 9.0 | — |
| redhat-codeready-linux-builder-eus | 8.6 | 8.6 | — |
| redhat-codeready-linux-builder-eus | 9.2 | 9.2 | — |
| redhat-codeready-linux-builder-eus | 9.4 | 9.4 | — |
| redhat-codeready-linux-builder-eus | 9.6 | 9.6 | — |
| redhat-codeready-linux-builder-for-arm64 | 9.0_aarch64 | 9.0_aarch64 | — |
| redhat-codeready-linux-builder-for-arm64-eus | 8.6 | 8.6 | — |
| redhat-codeready-linux-builder-for-arm64-eus | 9.2_aarch64 | 9.2_aarch64 | — |
| redhat-codeready-linux-builder-for-arm64-eus | 9.4_aarch64 | 9.4_aarch64 | — |
| redhat-codeready-linux-builder-for-arm64-eus | 9.6_aarch64 | 9.6_aarch64 | — |
| redhat-codeready-linux-builder-for-ibm-z-systems | 9.0_s390x | 9.0_s390x | — |
| redhat-codeready-linux-builder-for-ibm-z-systems-eus | 8.6 | 8.6 | — |
| redhat-codeready-linux-builder-for-ibm-z-systems-eus | 9.2_s390x | 9.2_s390x | — |
| redhat-codeready-linux-builder-for-ibm-z-systems-eus | 9.4_s390x | 9.4_s390x | — |
| redhat-codeready-linux-builder-for-ibm-z-systems-eus | 9.6_s390x | 9.6_s390x | — |
| redhat-codeready-linux-builder-for-power-little-endian | 9.0_ppc64le | 9.0_ppc64le | — |
| redhat-codeready-linux-builder-for-power-little-endian-eus | 8.6 | 8.6 | — |
| redhat-codeready-linux-builder-for-power-little-endian-eus | 9.2_ppc64le | 9.2_ppc64le | — |
| redhat-codeready-linux-builder-for-power-little-endian-eus | 9.4_ppc64le | 9.4_ppc64le | — |
| redhat-codeready-linux-builder-for-power-little-endian-eus | 9.6_ppc64le | 9.6_ppc64le | — |
| redhat-virtualization | 4.0 | 4.0 | — |
Kaynaklar
- NVD kaydı
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- bugzilla.redhat.com
- www.qualys.com
- www.qualys.com
- packetstormsecurity.com
- packetstormsecurity.com
- seclists.org
- www.openwall.com
- www.openwall.com
- www.openwall.com
- www.openwall.com
- www.openwall.com
- www.openwall.com
- www.openwall.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- CWE-122
- CISA KEV kataloğu