NetSight
IP …
low2.1Public exploit code

CVE-2010-3850

The ec_dev_ioctl function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2 does not require the CAP_NET_ADMIN capability, which allows local users…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The ec_dev_ioctl function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2 does not require the CAP_NET_ADMIN capability, which allows local users to bypass intended access restrictions and configure econet addresses via an SIOCSIFADDR ioctl call.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
before 2.6.36.2
SuseLinux Enterprise Desktop
Version 10
SuseLinux Enterprise Real Time Extension
Version 11
SuseLinux Enterprise Server
Versions 9, 10
SuseLinux Enterprise Software Development Kit
Version 10
DebianDebian Linux
Version 5.0
CanonicalUbuntu Linux
Versions 6.06, 8.04, 9.10, 10.04, 10.10

References