PT-2005-5453 · Suse+3 · Suse Linux+3

Lubomir Kundrak · Publicado 2005-12-31 · Atualizado 2018-10-30 · CVE-2005-4790

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SUSE Linux versions 9.3 and 10.0

Description The issue is caused by multiple untrusted search path vulnerabilities that add the working directory to LD LIBRARY PATH. This might allow local users to execute arbitrary code via certain applications. The affected applications include beagle, tomboy, and blam.

Recommendations For SUSE Linux versions 9.3 and 10.0, consider restricting access to the affected applications beagle, tomboy, and blam until a fix is available. As a temporary workaround, avoid using the LD LIBRARY PATH variable in sensitive operations to minimize the risk of exploitation. Restrict the working directory permissions to prevent unauthorized access.

Correção

Identificadores relacionados

CVE-2005-4790

Produtos afetados

Suse Linux

Beagle

Blam

Tomboy

Referências · 23

• https://usn.ubuntu.com/560-1 · Aviso do Fabricante
• http://secunia.com/advisories/28672 · Aviso do Fabricante
• http://secunia.com/advisories/27799 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-200801-14.xml · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-4790 · Nota de Segurança
• http://secunia.com/advisories/28339 · Aviso do Fabricante
• http://secunia.com/advisories/26480 · Aviso do Fabricante
• http://secunia.com/advisories/27621 · Aviso do Fabricante
• http://bugs.gentoo.org/show_bug.cgi?id=188806 · Nota
• http://bugs.gentoo.org/show_bug.cgi?id=199841 · Nota
• http://novell.com/linux/security/advisories/2005_22_sr.html · Aviso do Fabricante
• http://bugs.gentoo.org/show_bug.cgi?id=189249 · Nota
• https://redhat.com/archives/fedora-package-announce/2007-November/msg00206.html · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDVSA-2008:064 · Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2007-November/msg00913.html · Aviso do Fabricante