CVE-2010-0119: Infoleak
Published Feb 25, 2010
·Updated
Bournal before 1.4.1 on FreeBSD 8.0, when the -K option is used, places a ccrypt key on the command line, which allows local users to obtain sensitive information by listing the process and its arguments, related to "echoing."
Affected Software
30 affected components
Becauseinter Bournal<=1.4
Becauseinter Bournal=0.1
Becauseinter Bournal=0.2
Becauseinter Bournal=0.3
Becauseinter Bournal=0.4
Becauseinter Bournal=0.4.5
Becauseinter Bournal=0.6
Becauseinter Bournal=0.7
Becauseinter Bournal=0.8
Becauseinter Bournal=0.9
Becauseinter Bournal=1.0
Becauseinter Bournal=1.1
Becauseinter Bournal=1.2
Becauseinter Bournal=1.3
FreeBSD FreeBSD=8.0
All of the following
Any of the following
Becauseinter Bournal<=1.4
Becauseinter Bournal=0.1
Becauseinter Bournal=0.2
Becauseinter Bournal=0.3
Becauseinter Bournal=0.4
Becauseinter Bournal=0.4.5
Becauseinter Bournal=0.6
Becauseinter Bournal=0.7
Becauseinter Bournal=0.8
Becauseinter Bournal=0.9
Becauseinter Bournal=1.0
Becauseinter Bournal=1.1
Becauseinter Bournal=1.2
Becauseinter Bournal=1.3
FreeBSD FreeBSD=8.0
Event History
Feb 25, 2010
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
12:30 AM
DescriptionWeaknessAffected Software
Data Sourced
via NVD·12:30 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2010-0119?
CVE-2010-0119 is considered to have a medium severity level due to the potential exposure of sensitive information.
2
How do I fix CVE-2010-0119?
To fix CVE-2010-0119, update Bournal to version 1.4.1 or later.
3
Who is affected by CVE-2010-0119?
CVE-2010-0119 affects users of Bournal versions prior to 1.4.1 running on FreeBSD 8.0.
4
What type of information can be disclosed due to CVE-2010-0119?
CVE-2010-0119 could allow local users to obtain sensitive ccrypt keys through process listing.
5
What are the implications of CVE-2010-0119 for system security?
The implications of CVE-2010-0119 include an increased risk of unauthorized access to encrypted data if ccrypt keys are exposed.