PT-2002-1030 · Gnu · Sharutils

Publicado 2002-04-16 · Atualizado 2016-10-18 · CVE-2002-0178

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions sharutils versions prior to 4.2.1

Description The issue concerns the uudecode function in the sharutils package, which fails to check if the filename of the uudecoded file is a pipe or symbolic link. This could allow attackers to overwrite files or execute commands, potentially leading to a breach of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be carried out locally.

Recommendations For versions prior to 4.2.1, update to version 4.2.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the uudecode function to minimize the risk of exploitation.

Correção

Identificadores relacionados

BDU:2015-07824

CVE-2002-0178

Produtos afetados

Sharutils

Referências · 14

• http://kb.cert.org/vuls/id/336083 · Nota
• http://linux-mandrake.com/en/security/2002/MDKSA-2002-052.php · Aviso do Fabricante
• http://securityfocus.com/bid/4742 · Nota
• http://osvdb.org/8274 · Nota
• http://redhat.com/support/errata/RHSA-2002-065.html · Aviso do Fabricante
• http://online.securityfocus.com/advisories/4132 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=103599320902432&w=2 · Nota
• https://rhn.redhat.com/errata/RHSA-2002-065.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-0178 · Nota de Segurança
• http://iss.net/security_center/static/9075.php · Nota
• http://redhat.com/support/errata/RHSA-2003-180.html · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-07824 · Nota de Segurança
• ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-040.0.txt · Aviso do Fabricante
• http://aerasec.de/security/index.html?id=ae-200204-033&lang=en · Nota