« Volver al listado

CVE-2015-3407

Estado: ModificadaMedia (5)—

Module::Signature before 0.74 allows remote attackers to bypass signature verification for files via a signature file that does not list the files.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Canonical — Ubuntu LinuxModule-signature Project — Module-signature

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-3407",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-05-19T18:59:03.667",
  "references": [
    {
      "url": "http://ubuntu.com/usn/usn-2607-1",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.debian.org/security/2015/dsa-3261",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/04/07/1",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/04/23/17",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/audreyt/module-signature/commit/8a9164596fa5952d4fbcde5aa1c7d1c7bc85372f",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://metacpan.org/changes/distribution/Module-Signature",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://ubuntu.com/usn/usn-2607-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2015/dsa-3261",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/04/07/1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/04/23/17",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/audreyt/module-signature/commit/8a9164596fa5952d4fbcde5aa1c7d1c7bc85372f",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://metacpan.org/changes/distribution/Module-Signature",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Module::Signature before 0.74 allows remote attackers to bypass signature verification for files via a signature file that does not list the files."
    },
    {
      "lang": "es",
      "value": "Module::Signature anterior a 0.74 permite a atacantes remotos evadir la verificación de firmas para ficheros a través de un fichero de firmas que no lista los ficheros."
    }
  ],
  "lastModified": "2026-06-17T00:25:52.847",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "49A63F39-30BE-443F-AF10-6245587D3359"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F38D3B7E-8429-473F-BB31-FC3583EE5A5B"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:module-signature_project:module-signature:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B7FACC8-EC77-4980-8F34-E864C8F73963",
              "versionEndIncluding": "0.73"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}