CVE-2013-6876 Privilege escalation in n/a
Local attackers can gain privileges in s3dvt by exploiting setuid permissions combined with specific bash versions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-6876?
CVE-2013-6876 is a high-severity vulnerability in n/a, published on 6 Apr 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The (1) pty_init_terminal and (2) pipe_init_terminal functions in main.c in s3dvt 0.2.2 and earlier allows local users to gain privileges by leveraging setuid permissions and usage of bash 4.3 and earlier. NOTE: this vulnerability was fixed with commit ad732f00b411b092c66a04c359da0f16ec3b387, but the version number was not changed.
Weakness: CWE-264
Which versions are affected by CVE-2013-6876?
It affects 1 product.
Products include S3dvt Project S3dvt.
How do I fix CVE-2013-6876?
Apply the vendor's patch.
Is CVE-2013-6876 being exploited?
There is no known exploitation of CVE-2013-6876 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2013-6876, GHSA-qxrx-mx2h-xjr9.