VDB
CVE-2011-2147
CVE-2011-2147
PUBLISHED
CVSS 3.5999999046325684 LOW
Openswan 2.2.x does not properly restrict permissions for (1) /var/run/starter.pid, related to starter.c in the IPsec starter, and (2) /var/lock/subsys/ipsec, which allows local users to kill arbitrary processes by writing a PID to a file, or possibly bypass disk quotas by writing arbitrary data to a file, as demonstrated by files with 0666 permissions, a different vulnerability than CVE-2011-1784.
EPSS 0.34% · 26.7th percentile
Risk Scores
CVSS 2.0
3.5999999046325684
EPSS Score
0.34%
26.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| openswan | openswan | 2.2.1, 2.2.0 |
Timeline
- May 20, 2011 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 22, 2022 EPSS Score
- Jul 15, 2022 EPSS Score
- Sep 7, 2022 EPSS Score
- Oct 30, 2022 EPSS Score
- Dec 22, 2022 EPSS Score
- Feb 14, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 8, 2023 EPSS Score
- May 31, 2023 EPSS Score
References
- [debian-security] 20110510 Re: World writable pid and lock files. mailing-list
- https://nvd.nist.gov/vuln/detail/CVE-2011-2147 advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67822 technical
- http://lists.debian.org/debian-security/2011/05/msg00012.html technical
- http://lists.debian.org/debian-security/2011/05/msg00018.html technical