PT-2002-1520 · Ecartis · Ecartis

Publicado 2002-06-11 · Atualizado 2008-09-05 · CVE-2002-0469

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ecartis (formerly Listar) versions 1.0.0 and earlier

Description The issue arises when Ecartis is installed setuid-root, 'lock-to-user' is not set, and it is called by certain MTA's. In such cases, Ecartis does not properly drop privileges, which could allow local users to gain privileges.

Recommendations For Ecartis (formerly Listar) versions 1.0.0 and earlier, consider setting 'lock-to-user' to prevent privilege escalation. Additionally, ensure that Ecartis is not installed setuid-root unless necessary, and restrict its use with certain MTA's to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2002-0469

Produtos afetados

Ecartis

Referências · 5

• 🔥 http://securityfocus.com/bid/4277 · Exploit
• http://securityfocus.com/archive/1/261209 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-0469 · Nota de Segurança
• http://iss.net/security_center/static/8444.php · Aviso do Fabricante
• http://archives.neohapsis.com/archives/vulnwatch/2002-q1/0063.html · Nota