CVE-2009-1573
First published: Wed May 06 2009(Updated: )
xvfb-run 1.6.1 in Debian GNU/Linux, Ubuntu, Fedora 10, and possibly other operating systems place the magic cookie (MCOOKIE) on the command line, which allows local users to gain privileges by listing the process and its arguments.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Debian GNU/Linux | ||
| Fedora | =10 | |
| Ubuntu BusyBox Static | ||
| branden robinson xvfb-run | =1.6.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2009/05/05/4
- http://www.openwall.com/lists/oss-security/2009/05/05/2
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526678
- http://www.securityfocus.com/bid/34828
- http://secunia.com/advisories/39834
- http://www.ubuntu.com/usn/USN-939-1
- http://www.vupen.com/english/advisories/2010/1185
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50348
Frequently Asked Questions
What is the severity of CVE-2009-1573?
CVE-2009-1573 has a medium severity rating due to the potential for local privilege escalation.
How do I fix CVE-2009-1573?
To fix CVE-2009-1573, you should update the xvfb-run package to a version that does not expose the MCOOKIE on the command line.
Who is affected by CVE-2009-1573?
CVE-2009-1573 affects local users on Debian GNU/Linux, Ubuntu, Fedora 10, and possibly other operating systems.
What is the impact of CVE-2009-1573?
The impact of CVE-2009-1573 is that local users can gain elevated privileges by accessing the MCOOKIE from the command line.
When was CVE-2009-1573 reported?
CVE-2009-1573 was reported in May 2009.
- collector/nvd-historical
- agent/references
- agent/type
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/debian
- canonical/debian gnu/linux
- vendor/redhat
- canonical/fedora
- version/fedora/10
- vendor/ubuntu
- canonical/ubuntu busybox static
- vendor/branden robinson
- canonical/branden robinson xvfb-run
- version/branden robinson xvfb-run/1.6.1