CVE-2009-1296 - Vulnerability Details - OpenCVE

Description

The eCryptfs support utilities (ecryptfs-utils) 73-0ubuntu6.1 on Ubuntu 9.04 stores the mount passphrase in installation logs, which might allow local users to obtain access to the filesystem by reading the log files from disk. NOTE: the log files are only readable by root.

Published: 2009-06-09

Score: 1.9 Low

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:ubuntu:73-oubuntu:6.1:::::::*
	cpe:2.3:o:ubuntu:ubuntu:9.0.4:::::::*

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2009-1294	The eCryptfs support utilities (ecryptfs-utils) 73-0ubuntu6.1 on Ubuntu 9.04 stores the mount passphrase in installation logs, which might allow local users to obtain access to the filesystem by reading the log files from disk. NOTE: the log files are only readable by root.
Ubuntu USN	USN-783-1	eCryptfs vulnerability

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Local

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00068.

Key SSVC decision points have not yet been added.

References

Link	Providers
http://secunia.com/advisories/35383
http://www.securitytracker.com/id?1022347
http://www.ubuntu.com/usn/usn-783-1
https://exchange.xforce.ibmcloud.com/vulnerabilities/51191

History

No history.

Subscriptions

Ubuntu 73-oubuntu Ubuntu

MITRE

Status: PUBLISHED

Assigner: canonical

Published: 2009-06-09T20:00:00.000Z

Updated: 2024-08-07T05:04:49.427Z

Reserved: 2009-04-15T00:00:00.000Z

Link: CVE-2009-1296

Vulnrichment

No data.

NVD

Status : Modified

Published: 2009-06-09T20:30:00.280

Modified: 2026-04-23T00:35:47.467

Link: CVE-2009-1296

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-200

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2009-06-08T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "The eCryptfs support utilities (ecryptfs-utils) 73-0ubuntu6.1 on Ubuntu 9.04 stores the mount passphrase in installation logs, which might allow local users to obtain access to the filesystem by reading the log files from disk. NOTE: the log files are only readable by root."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-16T14:57:01.000Z", "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical"}, "references": [{"name": "35383", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/35383"}, {"name": "USN-783-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/usn-783-1"}, {"name": "1022347", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1022347"}, {"name": "ecryptfs-passphrase-info-disclosure(51191)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51191"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@ubuntu.com", "ID": "CVE-2009-1296", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The eCryptfs support utilities (ecryptfs-utils) 73-0ubuntu6.1 on Ubuntu 9.04 stores the mount passphrase in installation logs, which might allow local users to obtain access to the filesystem by reading the log files from disk. NOTE: the log files are only readable by root."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "35383", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/35383"}, {"name": "USN-783-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/usn-783-1"}, {"name": "1022347", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1022347"}, {"name": "ecryptfs-passphrase-info-disclosure(51191)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51191"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T05:04:49.427Z"}, "title": "CVE Program Container", "references": [{"name": "35383", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/35383"}, {"name": "USN-783-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/usn-783-1"}, {"name": "1022347", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1022347"}, {"name": "ecryptfs-passphrase-info-disclosure(51191)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51191"}]}]}, "cveMetadata": {"assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "assignerShortName": "canonical", "cveId": "CVE-2009-1296", "datePublished": "2009-06-09T20:00:00.000Z", "dateReserved": "2009-04-15T00:00:00.000Z", "dateUpdated": "2024-08-07T05:04:49.427Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ubuntu:73-oubuntu:6.1:*:*:*:*:*:*:*", "matchCriteriaId": "8F6E6F4C-968E-475C-9BF1-4D34ABBA8BE1", "vulnerable": true}, {"criteria": "cpe:2.3:o:ubuntu:ubuntu:9.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "24066D17-EE95-4E06-9FAC-DA9B2227195F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The eCryptfs support utilities (ecryptfs-utils) 73-0ubuntu6.1 on Ubuntu 9.04 stores the mount passphrase in installation logs, which might allow local users to obtain access to the filesystem by reading the log files from disk. NOTE: the log files are only readable by root."}, {"lang": "es", "value": "Las utilidades de soporte eCryptfs (ecryptfs-utils) 73-0ubuntu6.1 sobre Ubuntu v9.04, almacena almacena la \"passphrase\" de (frase clave) de montaje en los registros de instalaci\u00f3n, lo que podr\u00eda permitir a usuarios locales obtener acceso al sistema de ficheros mediante la lectura de los archivos de registro desde el disco. NOTA: los registros de archivos \u00fanicamente pueden ser le\u00eddos por el usuario root."}], "id": "CVE-2009-1296", "lastModified": "2026-04-23T00:35:47.467", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 1.9, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2009-06-09T20:30:00.280", "references": [{"source": "security@ubuntu.com", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/35383"}, {"source": "security@ubuntu.com", "url": "http://www.securitytracker.com/id?1022347"}, {"source": "security@ubuntu.com", "tags": ["Vendor Advisory"], "url": "http://www.ubuntu.com/usn/usn-783-1"}, {"source": "security@ubuntu.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51191"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/35383"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id?1022347"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.ubuntu.com/usn/usn-783-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51191"}], "sourceIdentifier": "security@ubuntu.com", "vendorComments": [{"comment": "Not vulnerable. This issue did not affect the versions of ecryptfs-utils as shipped with Red Hat Enterprise Linux 5. eCryptfs encrypted home directories are not set up during the system installation, so theres no possibility for leaking encryption passwords to the installation log file.", "lastModified": "2009-06-10T00:00:00", "organization": "Red Hat"}], "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}