CVE-2014-3209
First published: Sat May 03 2014(Updated: )
The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain the private key by reading the file.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/ldns | 1.7.1-2 1.8.3-1 1.8.4-1 | |
| NLnet Labs LDNS | =1.6.0 | |
| NLnet Labs LDNS | =1.6.1 | |
| NLnet Labs LDNS | =1.6.2 | |
| NLnet Labs LDNS | =1.6.3 | |
| NLnet Labs LDNS | =1.6.4 | |
| NLnet Labs LDNS | =1.6.5 | |
| NLnet Labs LDNS | =1.6.6 | |
| NLnet Labs LDNS | =1.6.7 | |
| NLnet Labs LDNS | =1.6.8 | |
| NLnet Labs LDNS | =1.6.9 | |
| NLnet Labs LDNS | =1.6.10 | |
| NLnet Labs LDNS | =1.6.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2014/05/03/2
- http://www.openwall.com/lists/oss-security/2014/05/05/4
- http://www.securityfocus.com/bid/67200
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746758
- https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=573
- https://security-tracker.debian.org/tracker/CVE-2014-3209
- http://git.nlnetlabs.nl/ldns/commit/?h=develop&id=169f38c1e25750f935838b670871056428977e6b
Frequently Asked Questions
What is the severity of CVE-2014-3209?
CVE-2014-3209 is considered a medium severity vulnerability due to potential exposure of sensitive private keys.
How do I fix CVE-2014-3209?
To remediate CVE-2014-3209, upgrade ldns to versions 1.7.1-2 or later.
What types of systems are affected by CVE-2014-3209?
CVE-2014-3209 affects systems running ldns versions 1.6.x prior to 1.7.1.
What specific risk does CVE-2014-3209 pose?
CVE-2014-3209 allows local users to read private key files due to inadequate permission settings based on current umask.
Is there a workaround for CVE-2014-3209 if I can't upgrade?
A potential workaround for CVE-2014-3209 is to manually adjust the umask settings before generating private keys to limit access.
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/debian-bugs
- source/Debian
- alias/CVE-2014-3209
- agent/severity
- agent/references
- agent/last-modified-date
- agent/author
- agent/weakness
- agent/description
- agent/softwarecombine
- agent/event
- collector/security-tracker-debian
- agent/software-canonical-lookup
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/debian
- vendor/nlnetlabs
- canonical/nlnet labs ldns
- version/nlnet labs ldns/1.6.0
- version/nlnet labs ldns/1.6.1
- version/nlnet labs ldns/1.6.2
- version/nlnet labs ldns/1.6.3
- version/nlnet labs ldns/1.6.4
- version/nlnet labs ldns/1.6.5
- version/nlnet labs ldns/1.6.6
- version/nlnet labs ldns/1.6.7
- version/nlnet labs ldns/1.6.8
- version/nlnet labs ldns/1.6.9
- version/nlnet labs ldns/1.6.10
- version/nlnet labs ldns/1.6.11