PT-2002-2691 · Sourcefire · Snortcenter

Publicado 2002-12-31 · Atualizado 2008-09-05 · CVE-2002-1970

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SnortCenter version 0.9.5

Description The issue allows local users to obtain usernames and passwords for the alert database servers due to the storage of Snort rules in a temporary file with world-readable and world-writable permissions when SnortCenter is configured to push Snort rules.

Recommendations For SnortCenter version 0.9.5, consider changing the permissions of the temporary file used to store Snort rules to prevent world-readable and world-writable access until a patch is available. As a temporary workaround, restrict access to the temporary file to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2002-1970

Produtos afetados

Snortcenter

Referências · 4

• http://securityfocus.com/bid/6109 · Correção
• http://online.securityfocus.com/archive/1/298587 · Correção
• http://iss.net/security_center/static/10540.php · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2002-1970 · Nota de Segurança