EUVD-2014-7083CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
pdns specific as packaged in Debian in version before 3.3.1-1 creates a too privileged MySQL user. It was discovered that the maintainer scripts of pdns-backend-mysql grant too wide database permissions for the pdns user. Other backends are not affected.
Analysis
pdns specific as packaged in Debian in version before 3.3.1-1 creates a too privileged MySQL user. It was discovered that the maintainer scripts of pdns-backend-mysql grant too wide database permissions for the pdns user. Other backends are not affected.
Technical Context
Privilege escalation allows a low-privileged user or process to gain elevated permissions beyond what was originally authorized. This vulnerability is classified as Incorrect Default Permissions (CWE-276).
Affected Products
Affected products: Debian Pdns, Debian Debian Linux 7.0
Remediation
A vendor patch is available — apply it immediately. Apply the principle of least privilege. Keep systems patched. Monitor for suspicious privilege changes. Use mandatory access controls (SELinux, AppArmor).
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| lucid | ignored | end of life |
| precise | ignored | end of life |
| upstream | released | 3.3.1-1 |
| utopic | not-affected | 3.3.1-4 |
| vivid | not-affected | - |
| wily | not-affected | - |
| xenial | not-affected | - |
| yakkety | not-affected | - |
| zesty | not-affected | - |
| artful | not-affected | - |
| bionic | not-affected | - |
| cosmic | not-affected | - |
| disco | not-affected | - |
| trusty | DNE | trusty/esm was DNE [trusty was needed] |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 4.4.1-1 | - |
| bookworm | fixed | 4.7.3-2 | - |
| trixie | fixed | 4.9.7-1 | - |
| forky, sid | fixed | 5.0.3-1 | - |
| squeeze | not-affected | - | - |
| wheezy | fixed | 3.1-4.1+deb7u1 | - |
| (unstable) | fixed | 3.3.1-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today