PT-2002-1282 · Oracle · Tarantella Enterprise 3

CVE-2002-0211 · Publicado 2002-05-16 · Atualizado 2024-02-14

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Média

Vetor base

AV:L/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tarantella Enterprise 3 versions 3.01 through 3.20

Description A race condition exists in the installation script, which creates a world-writeable temporary "gunzip" program before executing it. This could allow local users to execute arbitrary commands by modifying the program before it is executed.

Recommendations For Tarantella Enterprise 3 versions 3.01 through 3.20, consider restricting access to the temporary directory where the "gunzip" program is created to prevent unauthorized modifications. As a temporary workaround, consider disabling the execution of the installation script until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2002-0211

Produtos afetados

Tarantella Enterprise 3

Referências · 7

• 🔥 https://exploit-db.com/exploits/21244 · Exploit
• 🔥 http://online.securityfocus.com/archive/1/265845 · Exploit
• http://iss.net/security_center/static/7996.php · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=101208650722179&w=2 · Nota
• http://securityfocus.com/bid/3966 · Nota
• http://tarantella.com/security/bulletin-04.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-0211 · Nota de Segurança