CVE-2013-1060

Severity Score

6.9

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A certain Ubuntu build procedure for perf, as distributed in the Linux kernel packages in Ubuntu 10.04 LTS, 12.04 LTS, 12.10, 13.04, and 13.10, sets the HOME environment variable to the ~buildd directory and consequently reads the system configuration file from the ~buildd directory, which allows local users to gain privileges by leveraging control over the buildd account.

Cierto procedimiento build de Ubuntu para perf, tal y como es distribuido en los paquetes del kernel Linux en Ubuntu 10.04 LTS, 12.04 LTS, 12.10, 13.04, y 13.10, establece la variable de entorno HOME al directorio ~buildd y consecuentemente lee el fichero de configuración del sistema del directorio ~buildd, lo cual permite a usuarios locales obtener privilegios aprovechando el control sobre la cuenta buildd.

*Credits: N/A

CVSS Scores

NISTv2 6.9

Attack Vector

Local

Attack Complexity

Medium

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2013-01-11 CVE Reserved
2013-09-06 CVE Published
2023-03-08 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-264: Permissions, Privileges, and Access Controls

CAPEC

References (13)

URL	Tag	Source
https://launchpad.net/bugs/1206200	X_refsource_confirm
https://lists.ubuntu.com/archives/kernel-team/2013-July/031248.html	Mailing List
https://lists.ubuntu.com/archives/kernel-team/2013-July/031249.html	Mailing List

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://people.canonical.com/~ubuntu-security/cve/2013/CVE-2013-1060.html	2013-10-02
http://www.ubuntu.com/usn/USN-1938-1	2013-10-02
http://www.ubuntu.com/usn/USN-1939-1	2013-10-02
http://www.ubuntu.com/usn/USN-1941-1	2013-10-02
http://www.ubuntu.com/usn/USN-1942-1	2013-10-02
http://www.ubuntu.com/usn/USN-1943-1	2013-10-02
http://www.ubuntu.com/usn/USN-1944-1	2013-10-02
http://www.ubuntu.com/usn/USN-1945-1	2013-10-02
http://www.ubuntu.com/usn/USN-1946-1	2013-10-02
http://www.ubuntu.com/usn/USN-1947-1	2013-10-02

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				10.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "10.04"		lts		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				12.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.04"		lts		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				12.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.10"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				13.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "13.04"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				13.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "13.10"		-		Affected