CVE-2011-2916 — MEDIUM (5.5)

Vulnerability Description

qtnx 0.9 stores non-custom SSH keys in a world-readable configuration file. If a user has a world-readable or world-executable home directory, another local system user could obtain the private key used to connect to remote NX sessions.

CVSS Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Qtnx Project	Qtnx	0.9

Related Weaknesses (CWE)

CWE-312

References

https://access.redhat.com/security/cve/cve-2011-2916Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2916Issue TrackingThird Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-2916Third Party Advisory
https://access.redhat.com/security/cve/cve-2011-2916Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2916Issue TrackingThird Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-2916Third Party Advisory

FAQ

What is CVE-2011-2916?

CVE-2011-2916 is a vulnerability with a CVSS score of 5.5 (MEDIUM). qtnx 0.9 stores non-custom SSH keys in a world-readable configuration file. If a user has a world-readable or world-executable home directory, another local system user could obtain the private key us...

How severe is CVE-2011-2916?

CVE-2011-2916 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2011-2916?

Check the references section above for vendor advisories and patch information. Affected products include: Qtnx Project Qtnx.