CVE-2014-3209: Low severity nlnet labs ldns vulnerability
Published May 3, 2014
·Updated
The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain the private key by reading the file.
Affected Software
13 affected componentsFixes available
debian/ldns
1.7.1-21.8.3-11.8.4-1
nlnetlabs Ldns=1.6.0
nlnetlabs Ldns=1.6.1
nlnetlabs Ldns=1.6.2
nlnetlabs Ldns=1.6.3
nlnetlabs Ldns=1.6.4
nlnetlabs Ldns=1.6.5
nlnetlabs Ldns=1.6.6
nlnetlabs Ldns=1.6.7
nlnetlabs Ldns=1.6.8
nlnetlabs Ldns=1.6.9
nlnetlabs Ldns=1.6.10
nlnetlabs Ldns=1.6.11
Event History
May 3, 2014
Data Sourced
via Debian·10:45 AM
SeverityAffected Software
Nov 16, 2014
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Aug 6, 2024
Data Sourced
via Debian·10:47 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-3209?
CVE-2014-3209 is considered a medium severity vulnerability due to potential exposure of sensitive private keys.
2
How do I fix CVE-2014-3209?
To remediate CVE-2014-3209, upgrade ldns to versions 1.7.1-2 or later.
3
What types of systems are affected by CVE-2014-3209?
CVE-2014-3209 affects systems running ldns versions 1.6.x prior to 1.7.1.
4
What specific risk does CVE-2014-3209 pose?
CVE-2014-3209 allows local users to read private key files due to inadequate permission settings based on current umask.
5
Is there a workaround for CVE-2014-3209 if I can't upgrade?
A potential workaround for CVE-2014-3209 is to manually adjust the umask settings before generating private keys to limit access.