PT-2005-5324 · Ipcop · Ipcop

Juergen Schmidt · Publicado 2005-12-31 · Atualizado 2017-07-20 · CVE-2005-4659

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IPCop (aka IPCop Firewall) versions prior to 1.4.10

Description The issue allows local users to potentially overwrite system configuration files and gain privileges. This is possible by creating a malicious encrypted backup archive owned by "nobody" and then executing ipcoprscfg to restore from this backup.

Recommendations For versions prior to 1.4.10, update to version 1.4.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the backup.key file to prevent local users from exploiting the world-readable permissions.

Correção

Identificadores relacionados

CVE-2005-4659

Produtos afetados

Ipcop

Referências · 7

• http://securityfocus.com/bid/15377 · Correção
• http://sourceforge.net/tracker/index.php?func=detail&aid=1344032&group_id=40604&atid=428516 · Nota
• http://sourceforge.net/project/shownotes.php?release_id=369759 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23056 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4659 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4659 · Nota de Segurança
• http://secunia.com/advisories/17513 · Aviso do Fabricante