CVE-2016-1581

CWE-284 — Improper Access Control6 documents5 sources
Severity
5.5MEDIUM
EPSS
0.0%
top 89.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Canonical LXDCanonical Ubuntu Linux
Timeline
PublishedJun 9

Description

LXD before 2.0.2 uses world-readable permissions for /var/lib/lxd/zfs.img when setting up a loop based ZFS pool, which allows local users to copy and read data from arbitrary containers via unspecified vectors.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages2 packages

▶Ubuntulxd< 2.0.2-0ubuntu1~16.04.1
▶NVDcanonical/lxd2.0.1

Also affects: Ubuntu Linux 15.10, 16.04

🔴Vulnerability Details

3
CVEList
CVE-2016-1581: LXD before 2↗2016-06-09
▶
OSV
lxd vulnerabilities↗2016-05-31
▶
OSV
CVE-2016-1581: LXD before 2↗2016-05-31
▶

📋Vendor Advisories

2
Ubuntu
LXD vulnerabilities↗2016-05-31
▶
Debian
CVE-2016-1581: lxd - LXD before 2.0.2 uses world-readable permissions for /var/lib/lxd/zfs.img when s...↗2016
▶
CVE-2016-1581 (MEDIUM CVSS 5.5) | LXD before 2.0.2 uses world-readabl | cvebase.io