CVE-2016-1585 - Vulnerability Details - OpenCVE

In all versions of AppArmor mount rules are accidentally widened when compiled.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Canonical	Apparmor

Configuration 1 [-]

OR	cpe:2.3:a:canonical:apparmor::::::::
	cpe:2.3:a:canonical:apparmor::::::::
	cpe:2.3:a:canonical:apparmor::::::::

No data.

References

Link	Providers
https://bugs.launchpad.net/apparmor/+bug/1597017
https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E

History

Fri, 02 May 2025 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-254	NVD-CWE-noinfo
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: canonical

Published: 2019-04-22T15:35:59.573205Z

Updated: 2024-09-16T23:36:50.974Z

Reserved: 2016-01-12T00:00:00

Link: CVE-2016-1585

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2019-04-22T16:29:01.303

Modified: 2025-05-02T14:12:14.837

Link: CVE-2016-1585

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "apparmor", "vendor": "AppArmor", "versions": [{"status": "affected", "version": "all"}]}], "datePublic": "2016-06-28T00:00:00", "descriptions": [{"lang": "en", "value": "In all versions of AppArmor mount rules are accidentally widened when compiled."}], "metrics": [{"cvssV3_0": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.9, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "Improper translation of access control rules to policy.", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-02-25T16:06:47", "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://bugs.launchpad.net/apparmor/+bug/1597017"}, {"name": "[mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"}], "source": {"defect": ["https://bugs.launchpad.net/apparmor/+bug/1597017"], "discovery": "UNKNOWN"}, "title": "AppArmor mount rules grant excessive permissions", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@ubuntu.com", "DATE_PUBLIC": "2016-06-28T00:00:00.000Z", "ID": "CVE-2016-1585", "STATE": "PUBLIC", "TITLE": "AppArmor mount rules grant excessive permissions"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "apparmor", "version": {"version_data": [{"version_value": "all"}]}}]}, "vendor_name": "AppArmor"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In all versions of AppArmor mount rules are accidentally widened when compiled."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.9, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Improper translation of access control rules to policy."}]}]}, "references": {"reference_data": [{"name": "https://bugs.launchpad.net/apparmor/+bug/1597017", "refsource": "MISC", "url": "https://bugs.launchpad.net/apparmor/+bug/1597017"}, {"name": "[mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E"}]}, "source": {"defect": ["https://bugs.launchpad.net/apparmor/+bug/1597017"], "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T23:02:11.690Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bugs.launchpad.net/apparmor/+bug/1597017"}, {"name": "[mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"}]}]}, "cveMetadata": {"assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "assignerShortName": "canonical", "cveId": "CVE-2016-1585", "datePublished": "2019-04-22T15:35:59.573205Z", "dateReserved": "2016-01-12T00:00:00", "dateUpdated": "2024-09-16T23:36:50.974Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:canonical:apparmor:*:*:*:*:*:*:*:*", "matchCriteriaId": "BB29454C-443A-42AB-964A-7E697F175160", "versionEndExcluding": "2.13.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:canonical:apparmor:*:*:*:*:*:*:*:*", "matchCriteriaId": "2B54A239-7CBC-403C-8094-1D2FA09FA2B5", "versionEndExcluding": "3.0.12", "versionStartIncluding": "3.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:canonical:apparmor:*:*:*:*:*:*:*:*", "matchCriteriaId": "3BE2576D-BF6C-46B0-9786-7A92CEF92F10", "versionEndExcluding": "3.1.6", "versionStartIncluding": "3.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In all versions of AppArmor mount rules are accidentally widened when compiled."}, {"lang": "es", "value": "En todas las versiones de AppArmor, las reglas de montaje se ampl\u00edan accidentalmente cuando se compilan."}], "id": "CVE-2016-1585", "lastModified": "2025-05-02T14:12:14.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 3.9, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.0"}, "exploitabilityScore": 0.5, "impactScore": 3.4, "source": "security@ubuntu.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-04-22T16:29:01.303", "references": [{"source": "security@ubuntu.com", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugs.launchpad.net/apparmor/+bug/1597017"}, {"source": "security@ubuntu.com", "tags": ["Third Party Advisory"], "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugs.launchpad.net/apparmor/+bug/1597017"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}