A vulnerability classified as problematic was found in ace up to 6.2.7. This vulnerability affects some unknown functionality of the file generate_doygen.pl of the component Privileges. The manipulation with an unknown input leads to a random values vulnerability. The CWE definition for the vulnerability is CWE-330. The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

generate_doygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attackers to gain elevated privileges.

The bug was discovered 09/07/2014. The weakness was shared 11/22/2019. This vulnerability was named CVE-2014-6311 since 09/11/2014. Local access is required to approach this attack. A single authentication is required for exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1600.001 by the MITRE ATT&CK project.

The vulnerability was handled as a non-public zero-day exploit for at least 1902 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 6.2.7+dfsg-2 eliminates this vulnerability.

Productinfo

Name

• ace

Version

• 6.2.0
• 6.2.1
• 6.2.2
• 6.2.3
• 6.2.4
• 6.2.5
• 6.2.6
• 6.2.7

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion