PT-2005-5325 · Ipcop · Ipcop

Juergen Schmidt · Publicado 2005-12-31 · Atualizado 2008-09-05 · CVE-2005-4660

Positive Technologies (AI Summary)

CVSS v2.0

1.2

Baixa

Vetor base

AV:L/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IPCop (aka IPCop Firewall) versions prior to 1.4.10

Description A race condition issue exists that might allow local users to overwrite system configuration files and gain privileges. This occurs by replacing a backup archive during a specific time window when the archive is owned by "nobody" but not yet encrypted, and then executing ipcoprscfg to restore from this backup.

Recommendations For versions prior to 1.4.10, update to version 1.4.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the ipcoprscfg command until a patch is applied.

Correção

Identificadores relacionados

CVE-2005-4660

Produtos afetados

Ipcop

Referências · 5

• http://secunia.com/advisories/17513 · Correção
• http://securityfocus.com/bid/15378 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4660 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4660 · Nota
• http://sourceforge.net/tracker/index.php?func=detail&aid=1344047&group_id=40604&atid=428516 · Nota