PT-2003-1039 · Noweb · Noweb

Publicado 2003-06-20 · Atualizado 2008-09-05 · CVE-2003-0381

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions noweb versions 2.9 and earlier

Description The issue concerns multiple vulnerabilities in the noweb package that can lead to the compromise of protected information integrity. A local attacker can exploit these vulnerabilities. Technical details include the insecure creation of temporary files, allowing local users to overwrite arbitrary files through multiple vectors, including the noroff script.

Recommendations For noweb versions 2.9 and earlier, consider restricting access to the noroff script until a patch is available. As a temporary workaround, avoid using the noweb package for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

BDU:2015-04108

CVE-2003-0381

DSA-323

Produtos afetados

Noweb

Referências · 8

• https://bdu.fstec.ru/vul/2015-04108 · Nota de Segurança
• http://debian.org/security/2003/dsa-323 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2003-0381 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0381 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2003-0381 · Aviso do Fabricante
• http://debian.org/security/dsa-323 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0381 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2003-0381 · Nota de Segurança