CVE-2020-24331

high

Description

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon).

References

https://sourceforge.net/p/trousers/mailman/message/37015817/

https://seclists.org/oss-sec/2020/q2/att-135/tcsd_fixes.patch

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SSDL7COIFCZQMUBNAASNMKMX7W5JUHRD/

https://bugzilla.suse.com/show_bug.cgi?id=1164472

http://www.openwall.com/lists/oss-security/2020/08/14/1

Details

Source: Mitre, NVD

Published: 2020-08-13

Updated: 2024-11-21

Risk Information

CVSS v2

Base Score: 7.2

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H