PT-2005-1656 · Freebsd · Portupgrade

Simon L. Nielsen · Publicado 2005-04-12 · Atualizado 2008-09-05 · CVE-2005-0610

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions portupgrade versions prior to 20041226 2

Description The issue allows local users to overwrite arbitrary files, possibly replacing packages to execute arbitrary code via pkg fetch, or create arbitrary zero-byte files via the pkgdb.fixme temporary file. Additionally, it enables overwriting arbitrary files via temporary files when portupgrade upgrades a port or package.

Recommendations For versions prior to 20041226 2, update to version 20041226 2 or later to resolve the issue. As a temporary workaround, consider restricting access to the pkg fetch function and limiting the creation of temporary files during port or package upgrades. Avoid using the pkgdb.fixme temporary file until the issue is resolved.

Correção

Identificadores relacionados

CVE-2005-0610

Produtos afetados

Portupgrade

Referências · 4

• http://securityfocus.com/bid/13106 · Aviso do Fabricante
• http://vuxml.org/freebsd/22f00553-a09d-11d9-a788-0001020eed82.html · Aviso do Fabricante
• http://secunia.com/advisories/14903 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-0610 · Nota de Segurança