Upstream information

CVE-2016-4982 at MITRE

Description

authd sets weak permissions for /etc/ident.key, which allows local users to obtain the key by leveraging a race condition between the creation of the key, and the chmod to protect it.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having low severity.

CVSS v2 Scores
  National Vulnerability Database SUSE
Base Score 1.9 2.1
Vector AV:L/AC:M/Au:N/C:P/I:N/A:N AV:L/AC:L/Au:N/C:P/I:N/A:N
Access Vector Local Local
Access Complexity Medium Low
Authentication None None
Confidentiality Impact Partial Partial
Integrity Impact None None
Availability Impact None None
CVSS v3 Scores
  National Vulnerability Database
Base Score 4.7
Vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Access Vector Local
Access Complexity High
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Impact High
Integrity Impact None
Availability Impact None
SUSE Bugzilla entry: 984639 [RESOLVED]

No SUSE Security Announcements cross referenced.


Status of this issue by product and package

Product(s) Source package State
SUSE Linux Enterprise SDK 12 GA dovecot22 Ignore
SUSE Linux Enterprise SDK 12 SP1 dovecot22 Released
SUSE Linux Enterprise SDK 12 SP2 dovecot22 Released
SUSE Linux Enterprise Server 12 GA dovecot22 Affected
SUSE Linux Enterprise Server 12 SP1 dovecot22 Released
SUSE Linux Enterprise Server 12 SP2 dovecot22 Released
SUSE Linux Enterprise Server 12 SP2 for Raspberry PI dovecot22 Released