CVE-2014-1845: High severity enlightenment terminology vulnerability
An unspecified setuid root helper in Enlightenment before 0.17.6 allows local users to gain privileges by leveraging failure to properly sanitize the environment.
Other sources
These aren't security flaws, precisely, due to some of the other defaults that Fedora has that other distros/vendors may not, but upstream recently did some hardening to the defaults they provide (and we don't change) based on Martin Carpenter's report.
https://git.enlightenment.org/core/enlightenment.git/commit/?id=9456e88504cb5daddbac3f49373a3a9a8577e27a commit 9456e88504cb5daddbac3f49373a3a9a8577e27a Author: Carsten Haitzler (Rasterman) <raster> Date: Fri Dec 6 09:19:08 2013 +0900
esys - fix busy spin problem with security clamp-down
https://git.enlightenment.org/core/enlightenment.git/commit/?id=666df815cd86a50343859bce36c5cf968c5f38b0 commit 666df815cd86a50343859bce36c5cf968c5f38b0 Author: Carsten Haitzler (Rasterman) <raster> Date: Sun Dec 1 11:48:49 2013 +0900
esys - address security concerns with environment - more
add more environment variables to nuke and add alternate envrionment nuke method to raise security level.
https://git.enlightenment.org/core/enlightenment.git/commit/?id=bb4a21e98656fe2c7d98ba2163e6defe9a630e2b commit bb4a21e98656fe2c7d98ba2163e6defe9a630e2b Author: Carsten Haitzler (Rasterman) <raster> Date: Sat Nov 30 22:26:30 2013 +0900
esys - address security concerns with environment and gdb
1. clear out environment as best is possible before executing anything. especially PATH and IFS are set to minimal base defaults. also use clearenv() if available and unsetenv()
2. remove gdb method as it's just too dangerous. run it as normal as the user and if the kernel / distro dny that - then sorry. too bad.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1845?
CVE-2014-1845 is classified as a local privilege escalation vulnerability.
How do I fix CVE-2014-1845?
To fix CVE-2014-1845, update the Enlightenment software to version 0.17.6 or later.
Who is affected by CVE-2014-1845?
CVE-2014-1845 affects local users of the Enlightenment desktop environment prior to version 0.17.6.
Can CVE-2014-1845 be exploited remotely?
CVE-2014-1845 cannot be exploited remotely as it requires local access to the system.
What components of Enlightenment are affected by CVE-2014-1845?
CVE-2014-1845 affects the setuid root helper component of the Enlightenment desktop environment.