Paul Szabo

**Nome do Software Vulnerável e Versões Afetadas** BeyondTrust Privileged Remote Access (PRA) versões anteriores à 25.1 **Descrição** Uma vulnerabilidade de bypass de autenticação local afeta o BeyondTrust Privileged Remote Access (PRA). Isso permite que um atacante autenticado localmente visualize os detalhes de conexão de uma sessão ShellJump iniciada com ferramentas externas, possibilitando acesso não autorizado a sessões conectadas. **Recomendações** Para versões anteriores à 25.1, atualize para a versão 25.1 ou posterior para resolver o problema. Como solução temporária, considere restringir o acesso às sessões ShellJump iniciadas com ferramentas externas até que a atualização seja aplicada.

**Name of the Vulnerable Software and Affected Versions** tomcat6 versions 6.0.35 through 6.0.44 tomcat6 version 6.0.45+dfsg-1~deb7u3 and earlier tomcat7 versions 7.0.28 through 7.0.52 tomcat7 version 7.0.56-3+deb8u5 and earlier tomcat8 versions 8.0.14 through 8.0.32 tomcat8 version 8.0.37-1ubuntu0.1 and earlier tomcat8 version 8.0.38-2ubuntu0 and earlier **Description** The issue might allow local users with access to the tomcat account to obtain sensitive information or gain root privileges via a symlink attack on the Catalina localhost directory. **Recommendations** For tomcat6 versions 6.0.35 through 6.0.44, update to version 6.0.45+dfsg-1~deb7u4 or later. For tomcat6 version 6.0.45+dfsg-1~deb7u3 and earlier, update to version 6.0.45+dfsg-1~deb7u4 or later. For tomcat7 versions 7.0.28 through 7.0.52, update to version 7.0.56-3+deb8u6 or later. For tomcat7 version 7.0.56-3+deb8u5 and earlier, update to version 7.0.56-3+deb8u6 or later. For tomcat8 versions 8.0.14 through 8.0.32, update to version 8.0.32-1ubuntu1.3 or later. For tomcat8 version 8.0.37-1ubuntu0.1 and earlier, update to version 8.0.37-1ubuntu0.1 or later. For tomcat8 version 8.0.38-2ubuntu0 and earlier, update to version 8.0.38-2ubuntu1 or later.

**Name of the Vulnerable Software and Affected Versions** GNU gv versions prior to 3.7.0 **Description** The issue allows local users to overwrite arbitrary files via a symlink attack on a temporary file. **Recommendations** For GNU gv versions prior to 3.7.0, update to version 3.7.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Mathematica version 7 **Description** The issue allows local users to overwrite arbitrary files via a symlink attack on files within /tmp/MathLink/ or /tmp/fonts$$.conf when running on Linux. **Recommendations** For Mathematica version 7, consider restricting access to the /tmp/MathLink/ directory and the /tmp/fonts$$.conf file to prevent a symlink attack until a patch is available.

**Name of the Vulnerable Software and Affected Versions** libcgi-fast-perl (affected versions not specified) **Description** The issue concerns multiple vulnerabilities in the libcgi-fast-perl package of the Debian GNU/Linux operating system. These vulnerabilities can be exploited by a local attacker, potentially leading to breaches of confidentiality, integrity, and availability of protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ftpd versions (affected versions not specified) **Description** The issue allows remote authenticated users to list arbitrary directories with the privileges of gid 0, which could enable additional attack vectors. This occurs because ftpd sets the gid to the effective uid instead of the effective group id before executing /bin/ls. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** linux-ftpd version 0.17 **Description** The issue is related to the ftpd in Linux Netkit, where it does not check the return status of certain seteuid, setgid, and setuid calls. This could allow remote authenticated users to gain privileges if these calls fail due to reasons such as PAM failures or resource limits. **Recommendations** For linux-ftpd version 0.17, update to a version that includes a fix for this issue, as the current version does not properly handle the return status of seteuid, setgid, and setuid calls. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: linux-ftpd version 0.17 possibly other versions of linux-ftpd Description: The issue allows local users to bypass intended access restrictions. A local attacker can exploit this to redirect their home directory to a restricted directory, potentially leading to unauthorized access. Multiple vulnerabilities in the ftpd package of the Debian GNU/Linux operating system can be exploited by a local attacker, which may compromise the confidentiality, integrity, and availability of protected information. Recommendations: For linux-ftpd version 0.17, consider updating to a newer version that addresses this issue, if available. For possibly other versions of linux-ftpd, update to a version that includes the necessary security fixes. As a temporary workaround, consider restricting access to sensitive directories to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** gnome-pty-helper in GNOME libzvt2 and libvte4 (affected versions not specified) **Description** The issue allows local users to spoof the logon hostname by modifying the `DISPLAY` environment variable. There is a dispute regarding the severity of this issue. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Perl versions prior to 5.8.4 **Description** A race condition exists in the rmtree function in File::Path.pm, allowing local users to create arbitrary setuid binaries in the tree being deleted. **Recommendations** For versions prior to 5.8.4, update to version 5.8.4 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Eudora version 6.2.0.14 **Description** The issue allows remote attackers to read arbitrary files via spoofed "Converted" headers, as the software does not issue a warning when a user forwards an e-mail message that contains base64 or quoted-printable encoded attachments. **Recommendations** For version 6.2.0.14, consider disabling the forwarding of e-mail messages with encoded attachments until a fix is available. Restrict access to sensitive files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Perl versions 5.6.1 through 5.8.4 **Description** The issue is related to a race condition in the rmtree function within the File::Path module. This condition allows local users to potentially delete arbitrary files and directories, and possibly read files and directories, by exploiting a symlink attack. **Recommendations** For versions 5.6.1 through 5.8.4, consider applying configuration changes to restrict file and directory access until a patch is available. As a temporary workaround, restrict the use of the rmtree function in the File::Path module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Eudora for Windows versions 5.2.1, 6.0.3, 6.1 **Description** The issue allows remote attackers to execute arbitrary code via an e-mail with a link to a long URL to the C drive or a long attachment name. This is due to a buffer overflow. **Recommendations** For Eudora for Windows version 5.2.1, update to a version that fixes the buffer overflow issue. For Eudora for Windows version 6.0.3, update to a version that fixes the buffer overflow issue. For Eudora for Windows version 6.1, update to a version that fixes the buffer overflow issue.

**Name of the Vulnerable Software and Affected Versions** Eudora versions 6.0.3 through 6.1 **Description** The issue allows remote attackers to cause a denial of service, resulting in a crash, by sending a deeply nested multipart MIME message. **Recommendations** For versions 6.0.3 through 6.1, consider disabling the handling of multipart MIME messages until a patch is available.

**Name of the Vulnerable Software and Affected Versions** suidperl versions 5.6.1 and earlier **Description** The issue allows a local user to obtain sensitive information about files for which the user does not have appropriate permissions. **Recommendations** For suidperl versions 5.6.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: VMware Workstation version 4.0.1 and earlier Description: The issue allows local users to delete arbitrary files via a symlink attack. Recommendations: For versions 4.0.1 and earlier, update to a version later than 4.0.1 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: VMware GSX Server versions 2.5.1 build 4968 and earlier VMware Workstation versions 4.0 and earlier Description: The issue allows local users to gain root privileges via certain environment variables that are used when launching a virtual machine session. Recommendations: For VMware GSX Server versions 2.5.1 build 4968 and earlier, consider restricting the use of environment variables when launching virtual machine sessions until a fix is available. For VMware Workstation versions 4.0 and earlier, consider restricting the use of environment variables when launching virtual machine sessions until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Adobe Acrobat Reader versions 5.0.7 and earlier Description: A buffer overflow issue exists in the WWWLaunchNetscape function, allowing remote attackers to execute arbitrary code via a .pdf file with a long mailto link. Recommendations: For Adobe Acrobat Reader versions 5.0.7 and earlier, update to a version later than 5.0.7 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Eudora version 5.2.1 Description: The issue is related to a buffer overflow that can be triggered by an Attachment Converted argument containing a large number of `.` (dot) characters. This can cause a denial of service, resulting in a crash and failed restart, and potentially allow the execution of arbitrary code. Recommendations: For Eudora version 5.2.1, consider avoiding the use of Attachment Converted arguments with a large number of `.` (dot) characters until a fix is available. As a temporary workaround, restrict the handling of such arguments to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Name of the Vulnerable Software and Affected Versions: Qualcomm Eudora version 5.2.1 Description: The issue allows remote attackers to read arbitrary files via an email message with a carriage return (CR) character in a spoofed "Attachment Converted:" string, which is not properly handled by the software. Recommendations: For Qualcomm Eudora version 5.2.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.