CVE-2013-2207
Summary
| CVE | CVE-2013-2207 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2013-10-09 22:55:02 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | pt_chown in GNU C Library (aka glibc or libc6) before 2.18 does not properly check permissions for tty files, which allows local users to change the permission on the files and obtain access to arbitrary pseudo-terminals by leveraging a FUSE file system. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
LocalAccess Complexity
HighAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
NoneAV:L/AC:H/Au:N/C:P/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Fedoraproject | Fedora | 18 | All | All | All |
| Operating System | Fedoraproject | Fedora | 19 | All | All | All |
| Application | Gnu | Glibc | 2.0 | All | All | All |
| Application | Gnu | Glibc | 2.0.1 | All | All | All |
| Application | Gnu | Glibc | 2.0.2 | All | All | All |
| Application | Gnu | Glibc | 2.0.3 | All | All | All |
| Application | Gnu | Glibc | 2.0.4 | All | All | All |
| Application | Gnu | Glibc | 2.0.5 | All | All | All |
| Application | Gnu | Glibc | 2.0.6 | All | All | All |
| Application | Gnu | Glibc | 2.1 | All | All | All |
| Application | Gnu | Glibc | 2.1.1 | All | All | All |
| Application | Gnu | Glibc | 2.1.1.6 | All | All | All |
| Application | Gnu | Glibc | 2.1.2 | All | All | All |
| Application | Gnu | Glibc | 2.1.3 | All | All | All |
| Application | Gnu | Glibc | 2.1.9 | All | All | All |
| Application | Gnu | Glibc | 2.10.1 | All | All | All |
| Application | Gnu | Glibc | 2.11 | All | All | All |
| Application | Gnu | Glibc | 2.11.1 | All | All | All |
| Application | Gnu | Glibc | 2.11.2 | All | All | All |
| Application | Gnu | Glibc | 2.11.3 | All | All | All |
| Application | Gnu | Glibc | 2.12.1 | All | All | All |
| Application | Gnu | Glibc | 2.12.2 | All | All | All |
| Application | Gnu | Glibc | 2.13 | All | All | All |
| Application | Gnu | Glibc | 2.14 | All | All | All |
| Application | Gnu | Glibc | 2.14.1 | All | All | All |
| Application | Gnu | Glibc | 2.15 | All | All | All |
| Application | Gnu | Glibc | 2.16 | All | All | All |
| Application | Gnu | Glibc | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| 976408 – (CVE-2013-2207) CVE-2013-2207 glibc (pt_chown): Improper pseudotty ownership and permissions changes when granting access to the slave pseudoterminal | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Patch |
| 15755 – (CVE-2013-2207) CVE-2013-2207: pt_chown tricked into granting access to another users pseudo-terminal | af854a3a-2127-422b-91ae-364da2661108 | sourceware.org | Patch |
| [security-announce] SUSE-SU-2015:1424-1: important: Security update for | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| [security-announce] SUSE-SU-2016:0470-1: important: Security update for | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| About Secunia Research | Flexera | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Gentoo Security | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| USN-2985-1: GNU C Library vulnerabilities | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntu.com | |
| USN-2985-2: GNU C Library regression | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntu.com | |
| David Miller - The GNU C Library version 2.18 is now available | af854a3a-2127-422b-91ae-364da2661108 | sourceware.org | |
| Support / Security / Advisories / / MDVSA-2013:283 | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.