PT-2002-1607 · Openbsd · Openbsd

Publicado 2002-06-11 · Atualizado 2008-09-05 · CVE-2002-0557

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenBSD version 3.0

Description The issue causes problems when using YP with netgroups in the password database. This can lead to unauthorized access, where (1) rexec or (2) rsh can run another user's shell, or (3) atrun can change to a different user's directory. The cause might be related to memory allocation failures or an incorrect call to auth approval().

Recommendations For OpenBSD version 3.0, consider restricting the use of YP with netgroups in the password database until a fix is available. As a temporary workaround, limit the use of rexec, rsh, and atrun to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2002-0557

Produtos afetados

Openbsd

Referências · 4

• http://openbsd.org/errata30.html#approval · Aviso do Fabricante
• http://securityfocus.com/bid/4338 · Aviso do Fabricante
• http://iss.net/security_center/static/8625.php · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-0557 · Nota de Segurança