Skip to main content

Bareos CVE-2017-14610

HIGH
Improper Initialization (CWE-665)
2017-09-20 cve@mitre.org
Information Disclosure Bareos
7.8
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Sep 20, 2017 - 18:29 cve.org
HIGH 7.8

DescriptionCVE.org

bareos-dir, bareos-fd, and bareos-sd in bareos-core in Bareos 16.2.6 and earlier create a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname" command.

AnalysisAI

bareos-dir, bareos-fd, and bareos-sd in bareos-core in Bareos 16.2.6 and earlier create a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-665. bareos-dir, bareos-fd, and bareos-sd in bareos-core in Bareos 16.2.6 and earlier create a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname" command. Affected products include: Bareos.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Bareos

View all
CVE-2022-24755 CRITICAL POC
9.8 Mar 15

Bareos is open source software for backup, archiving, and recovery of data for operating systems. Rated critical severit
CVE-2022-24756 HIGH POC
7.5 Mar 15

Bareos is open source software for backup, archiving, and recovery of data for operating systems. Rated high severity (C
CVE-2020-11061 HIGH
7.4 Jul 10

In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client

CVE-2020-4042 MEDIUM
6.8 Jul 10

Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of

Same weakness CWE-665 – Improper Initialization

View all
CVE-2022-0847 HIGH POC
7.8
CVE-2013-1675 MEDIUM POC
6.5
CVE-2023-1719 CRITICAL POC
9.8
CVE-2022-36061 CRITICAL POC
9.8
CVE-2022-37128 CRITICAL POC
9.8
CVE-2019-20063 HIGH POC
8.8
CVE-2017-13715 CRITICAL
9.8
CVE-2017-14609 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2017-14610 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy