CVE-2011-1011: Medium severity red hat python 3 policycoreutils vulnerability
Published Sep 13, 2010
·Updated
Tavis Ormandy reported that seunshare, part of policycoreutils, was shipped setuid root and failed to enforce proper permissions on an alternate temporary directory mounted as /tmp. This could potentially lead to privilege escalation in certain privileged applications that assume /tmp to be sticky and root-owned.
Acknowledgements:
Red Hat would like to thank Tavis Ormandy for reporting this issue.
Other sources
The seunsharemount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of policycoreutils 2.0.83 and earlier in Red Hat Enterprise Linux (RHEL) 6 and earlier, and Fedora 14 and earlier, mounts a new directory on top of /tmp without assigning root ownership and the sticky bit to this new directory, which allows local users to replace or delete arbitrary /tmp files, and consequently cause a denial of service or possibly gain privileges, by running a setuid application that relies on /tmp, as demonstrated by the ksu application.
Affected Software
270 affected components
redhat Policycoreutils<=2.0.83
redhat Policycoreutils=1.0
redhat Policycoreutils=1.1
redhat Policycoreutils=1.2
redhat Policycoreutils=1.4
redhat Policycoreutils=1.6
redhat Policycoreutils=1.8
redhat Policycoreutils=1.10
redhat Policycoreutils=1.12
redhat Policycoreutils=1.14
redhat Policycoreutils=1.16
redhat Policycoreutils=1.18
redhat Policycoreutils=1.20
redhat Policycoreutils=1.21.1
redhat Policycoreutils=1.21.2
redhat Policycoreutils=1.21.3
redhat Policycoreutils=1.21.4
redhat Policycoreutils=1.21.5
redhat Policycoreutils=1.21.6
redhat Policycoreutils=1.21.7
redhat Policycoreutils=1.21.8
redhat Policycoreutils=1.21.9
redhat Policycoreutils=1.21.10
redhat Policycoreutils=1.21.11
redhat Policycoreutils=1.21.12
redhat Policycoreutils=1.21.13
redhat Policycoreutils=1.21.14
redhat Policycoreutils=1.21.15
redhat Policycoreutils=1.21.16
redhat Policycoreutils=1.21.17
redhat Policycoreutils=1.21.18
redhat Policycoreutils=1.21.19
redhat Policycoreutils=1.21.20
redhat Policycoreutils=1.21.21
redhat Policycoreutils=1.21.22
redhat Policycoreutils=1.22
redhat Policycoreutils=1.23.1
redhat Policycoreutils=1.23.2
redhat Policycoreutils=1.23.3
redhat Policycoreutils=1.23.4
redhat Policycoreutils=1.23.5
redhat Policycoreutils=1.23.6
redhat Policycoreutils=1.23.7
redhat Policycoreutils=1.23.8
redhat Policycoreutils=1.23.9
redhat Policycoreutils=1.23.10
redhat Policycoreutils=1.23.11
redhat Policycoreutils=1.24
redhat Policycoreutils=1.25.1
redhat Policycoreutils=1.25.2
redhat Policycoreutils=1.25.3
redhat Policycoreutils=1.25.4
redhat Policycoreutils=1.25.5
redhat Policycoreutils=1.25.6
redhat Policycoreutils=1.25.7
redhat Policycoreutils=1.25.8
redhat Policycoreutils=1.25.9
redhat Policycoreutils=1.26
redhat Policycoreutils=1.27.1
redhat Policycoreutils=1.27.2
redhat Policycoreutils=1.27.3
redhat Policycoreutils=1.27.4
redhat Policycoreutils=1.27.5
redhat Policycoreutils=1.27.6
redhat Policycoreutils=1.27.7
redhat Policycoreutils=1.27.8
redhat Policycoreutils=1.27.9
redhat Policycoreutils=1.27.10
redhat Policycoreutils=1.27.11
redhat Policycoreutils=1.27.12
redhat Policycoreutils=1.27.13
redhat Policycoreutils=1.27.14
redhat Policycoreutils=1.27.15
redhat Policycoreutils=1.27.16
redhat Policycoreutils=1.27.17
redhat Policycoreutils=1.27.18
redhat Policycoreutils=1.27.19
redhat Policycoreutils=1.27.20
redhat Policycoreutils=1.27.21
redhat Policycoreutils=1.27.22
redhat Policycoreutils=1.27.23
redhat Policycoreutils=1.27.24
redhat Policycoreutils=1.27.25
redhat Policycoreutils=1.27.26
redhat Policycoreutils=1.27.27
redhat Policycoreutils=1.27.28
redhat Policycoreutils=1.27.29
redhat Policycoreutils=1.27.30
redhat Policycoreutils=1.27.31
redhat Policycoreutils=1.27.32
redhat Policycoreutils=1.27.33
redhat Policycoreutils=1.27.34
redhat Policycoreutils=1.27.35
redhat Policycoreutils=1.27.36
redhat Policycoreutils=1.27.37
redhat Policycoreutils=1.28
redhat Policycoreutils=1.29.1
redhat Policycoreutils=1.29.2
redhat Policycoreutils=1.29.3
redhat Policycoreutils=1.29.4
redhat Policycoreutils=1.29.5
redhat Policycoreutils=1.29.6
redhat Policycoreutils=1.29.7
redhat Policycoreutils=1.29.8
redhat Policycoreutils=1.29.9
redhat Policycoreutils=1.29.10
redhat Policycoreutils=1.29.11
redhat Policycoreutils=1.29.12
redhat Policycoreutils=1.29.13
redhat Policycoreutils=1.29.14
redhat Policycoreutils=1.29.15
redhat Policycoreutils=1.29.16
redhat Policycoreutils=1.29.17
redhat Policycoreutils=1.29.18
redhat Policycoreutils=1.29.19
redhat Policycoreutils=1.29.20
redhat Policycoreutils=1.29.21
redhat Policycoreutils=1.29.22
redhat Policycoreutils=1.29.23
redhat Policycoreutils=1.29.24
redhat Policycoreutils=1.29.25
redhat Policycoreutils=1.29.26
redhat Policycoreutils=1.29.27
redhat Policycoreutils=1.29.28
redhat Policycoreutils=1.30
redhat Policycoreutils=1.30.1
redhat Policycoreutils=1.30.2
redhat Policycoreutils=1.30.3
redhat Policycoreutils=1.30.4
redhat Policycoreutils=1.30.5
redhat Policycoreutils=1.30.6
redhat Policycoreutils=1.30.7
redhat Policycoreutils=1.30.8
redhat Policycoreutils=1.30.9
redhat Policycoreutils=1.30.10
redhat Policycoreutils=1.30.11
redhat Policycoreutils=1.30.12
redhat Policycoreutils=1.30.13
redhat Policycoreutils=1.30.14
redhat Policycoreutils=1.30.15
redhat Policycoreutils=1.30.16
redhat Policycoreutils=1.30.17
redhat Policycoreutils=1.30.18
redhat Policycoreutils=1.30.19
redhat Policycoreutils=1.30.20
redhat Policycoreutils=1.30.21
redhat Policycoreutils=1.30.22
redhat Policycoreutils=1.30.23
redhat Policycoreutils=1.30.24
redhat Policycoreutils=1.30.25
redhat Policycoreutils=1.30.26
redhat Policycoreutils=1.30.27
redhat Policycoreutils=1.30.28
redhat Policycoreutils=1.30.29
redhat Policycoreutils=1.30.30
redhat Policycoreutils=1.30.31
redhat Policycoreutils=1.32
redhat Policycoreutils=1.33.1
redhat Policycoreutils=1.33.2
redhat Policycoreutils=1.33.3
redhat Policycoreutils=1.33.4
redhat Policycoreutils=1.33.5
redhat Policycoreutils=1.33.6
redhat Policycoreutils=1.33.7
redhat Policycoreutils=1.33.8
redhat Policycoreutils=1.33.9
redhat Policycoreutils=1.33.10
redhat Policycoreutils=1.33.11
redhat Policycoreutils=1.33.12
redhat Policycoreutils=1.33.13
redhat Policycoreutils=1.33.14
redhat Policycoreutils=1.33.15
redhat Policycoreutils=1.33.16
redhat Policycoreutils=1.34.0
redhat Policycoreutils=1.34.1
redhat Policycoreutils=2.0.0
redhat Policycoreutils=2.0.1
redhat Policycoreutils=2.0.2
redhat Policycoreutils=2.0.3
redhat Policycoreutils=2.0.4
redhat Policycoreutils=2.0.5
redhat Policycoreutils=2.0.6
redhat Policycoreutils=2.0.7
redhat Policycoreutils=2.0.8
redhat Policycoreutils=2.0.9
redhat Policycoreutils=2.0.10
redhat Policycoreutils=2.0.11
redhat Policycoreutils=2.0.12
redhat Policycoreutils=2.0.13
redhat Policycoreutils=2.0.14
redhat Policycoreutils=2.0.15
redhat Policycoreutils=2.0.16
redhat Policycoreutils=2.0.17
redhat Policycoreutils=2.0.18
redhat Policycoreutils=2.0.19
redhat Policycoreutils=2.0.20
redhat Policycoreutils=2.0.21
redhat Policycoreutils=2.0.22
redhat Policycoreutils=2.0.23
redhat Policycoreutils=2.0.24
redhat Policycoreutils=2.0.25
redhat Policycoreutils=2.0.26
redhat Policycoreutils=2.0.27
redhat Policycoreutils=2.0.28
redhat Policycoreutils=2.0.29
redhat Policycoreutils=2.0.30
redhat Policycoreutils=2.0.31
redhat Policycoreutils=2.0.32
redhat Policycoreutils=2.0.33
redhat Policycoreutils=2.0.34
redhat Policycoreutils=2.0.35
redhat Policycoreutils=2.0.36
redhat Policycoreutils=2.0.37
redhat Policycoreutils=2.0.38
redhat Policycoreutils=2.0.39
redhat Policycoreutils=2.0.40
redhat Policycoreutils=2.0.41
redhat Policycoreutils=2.0.42
redhat Policycoreutils=2.0.43
redhat Policycoreutils=2.0.44
redhat Policycoreutils=2.0.45
redhat Policycoreutils=2.0.46
redhat Policycoreutils=2.0.47
redhat Policycoreutils=2.0.48
redhat Policycoreutils=2.0.49
redhat Policycoreutils=2.0.50
redhat Policycoreutils=2.0.51
redhat Policycoreutils=2.0.52
redhat Policycoreutils=2.0.53
redhat Policycoreutils=2.0.54
redhat Policycoreutils=2.0.55
redhat Policycoreutils=2.0.56
redhat Policycoreutils=2.0.57
redhat Policycoreutils=2.0.58
redhat Policycoreutils=2.0.59
redhat Policycoreutils=2.0.60
redhat Policycoreutils=2.0.61
redhat Policycoreutils=2.0.62
redhat Policycoreutils=2.0.63
redhat Policycoreutils=2.0.64
redhat Policycoreutils=2.0.65
redhat Policycoreutils=2.0.66
redhat Policycoreutils=2.0.67
redhat Policycoreutils=2.0.68
redhat Policycoreutils=2.0.69
redhat Policycoreutils=2.0.70
redhat Policycoreutils=2.0.71
redhat Policycoreutils=2.0.72
redhat Policycoreutils=2.0.73
redhat Policycoreutils=2.0.74
redhat Policycoreutils=2.0.75
redhat Policycoreutils=2.0.76
redhat Policycoreutils=2.0.77
redhat Policycoreutils=2.0.78
redhat Policycoreutils=2.0.79
redhat Policycoreutils=2.0.80
redhat Policycoreutils=2.0.81
redhat Policycoreutils=2.0.82
redhat Enterprise Linux=3
redhat Enterprise Linux=4
redhat Enterprise Linux=5
redhat Enterprise Linux=6.0
redhat Fedora=6
redhat Fedora=7
redhat Fedora=8
redhat Fedora=9
redhat Fedora=10
redhat Fedora=12
redhat Fedora=13
redhat Fedora=14
Remediation
Patch Available
Event History
Sep 13, 2010
Data Sourced
via Red Hat·10:13 PM
DescriptionSeverityAffected Software
Feb 24, 2011
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Data Sourced
09:00 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2011-1011?
CVE-2011-1011 has a severity rating that is classified as high due to its potential for privilege escalation.
2
How do I fix CVE-2011-1011?
To address CVE-2011-1011, upgrade the affected versions of policycoreutils to the latest available versions or apply the recommended patches.
3
What systems are affected by CVE-2011-1011?
CVE-2011-1011 affects various versions of Red Hat's policycoreutils, particularly versions up to 2.0.83 and several specific older versions.
4
What is the main risk associated with CVE-2011-1011?
The main risk of CVE-2011-1011 is the potential for unauthorized privilege escalation in applications that assume secure handling of temporary files.
5
Is CVE-2011-1011 still a concern for current systems?
While CVE-2011-1011 was reported years ago, it remains a concern for systems that have not been updated or remain on vulnerable versions of policycoreutils.