IM
IronMonkey Threat Research

CVE-2020-13776 MEDIUM

Published: 2020-06-03 | Last Modified: 2025-06-09 | Status: Modified

Description

systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.

Additional Descriptions (1)

systemd versiones hasta v245 maneja inapropiadamente los nombres de usuario numéricos, tales como los compuestos por dígitos decimales o 0x seguidos de dígitos hexadecimales, como es demostrado por el uso de privilegios root cuando era previsto privilegios de la cuenta de usuario 0x0. NOTA: este problema se presenta debido a una corrección incompleta para CVE-2017-1000082.

CVSS Metrics

Base Score: 6.7 (MEDIUM)

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack VectorLOCAL
Attack ComplexityHIGH
Privileges RequiredLOW
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 0.8

Impact Score: 5.9

Base Score: 6.2 (MEDIUM)

AV:L/AC:H/Au:N/C:C/I:C/A:C

Access VectorLOCAL
Access ComplexityHIGH
AuthenticationNONE
Confidentiality ImpactCOMPLETE
Integrity ImpactCOMPLETE
Availability ImpactCOMPLETE

Source: [email protected]

Type: Primary

Exploitability Score: 1.9

Impact Score: 10.0

Weaknesses

Source Type Description
[email protected] Primary
en CWE-269
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-269

Affected Products

Vendor Product Version Update Type
systemd_project systemd * <built-in method update of dict object at 0x7fd2d825a080> Application
netapp active_iq_unified_manager - <built-in method update of dict object at 0x7fd36945d000> Application
netapp solidfire_\&_hci_management_node - <built-in method update of dict object at 0x7fd368d83140> Application
fedoraproject fedora 32 <built-in method update of dict object at 0x7fd3401d4980> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:systemd_project:systemd:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
Yes cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

References