PT-2008-1006 · Debian · Apt-Listchanges

Publicado 2008-01-17 · Atualizado 2008-09-05 · CVE-2008-0302

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions apt-listchanges versions prior to 2.82

Description The issue is related to an untrusted search path vulnerability in the apt-listchanges.py script. This vulnerability allows local users to execute arbitrary code via a malicious apt-listchanges program in the current working directory. Multiple vulnerabilities in the apt-listchanges package may lead to breaches of confidentiality, integrity, and availability of protected information.

Recommendations For versions prior to 2.82, update to version 2.82 or later to resolve the issue. As a temporary workaround, consider restricting access to the apt-listchanges.py script until a patch is available. Avoid executing the script from untrusted directories to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

BDU:2015-00794

CVE-2008-0302

DSA-1465-2

Produtos afetados

Apt-Listchanges

Referências · 15

• 🔥 http://git.madism.org/?p=apt-listchanges.git;a=commitdiff;h=1bcfbf3dc55413bb83a1782dc9a54515a963fb32 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0302 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2008-0302 · Aviso do Fabricante
• http://secunia.com/advisories/28574 · Nota
• http://securityfocus.com/bid/27331 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0302 · Nota de Segurança
• http://ubuntu.com/usn/usn-572-1 · Aviso do Fabricante
• http://git.madism.org/?p=apt-listchanges.git%3Ba=commitdiff%3Bh=1bcfbf3dc55413bb83a1782dc9a54515a963fb32 · Nota
• http://debian.org/security/2008/dsa-1465 · Aviso do Fabricante
• http://secunia.com/advisories/28513 · Nota
• http://packages.debian.org/changelogs/pool/main/a/apt-listchanges/apt-listchanges_2.82/changelog · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-0302 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2008-0302 · Aviso do Fabricante
• http://debian.org/security/dsa-1465 · Nota
• https://bdu.fstec.ru/vul/2015-00794 · Nota de Segurança