PT-2004-3229 · Macromedia+1 · Director+7

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-2335

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Macromedia Contribute 2, Director, Dreamweaver, Fireworks, Flash, and Studio (affected versions not specified)

Description: The issue concerns the Macromedia installers and e-licensing client on Mac OS X. It allows local users to gain privileges by modifying the AuthenticationService program, which is installed setuid and is writable by other users.

Recommendations: For the affected Macromedia products, consider restricting access to the AuthenticationService program until a fix is available. As a temporary workaround, consider disabling the setuid bit on the AuthenticationService program to prevent unauthorized modifications. Restrict write access to the AuthenticationService program to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2004-2335

Produtos afetados

Authenticationservice

Director

Dreamweaver

Fireworks

Flash

Macos X

Macromedia Contribute

Studio

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2004-2335 · Nota de Segurança
• http://secunia.com/advisories/11123 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15465 · Nota
• http://macromedia.com/devnet/security/security_zone/mpsb04-03.html · Aviso do Fabricante
• http://securityfocus.com/bid/9862 · Correção