PT-2008-1030 · Suphp · Suphp

Felix Schwarz

·

Publicado

2008-04-02

·

Atualizado

2017-08-08

·

CVE-2008-1614

CVSS v2.0

4.3

Média

VetorAV:L/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions suPHP versions prior to 0.6.3
Description The issue allows local users to gain privileges through a race condition involving multiple symlink changes to point a file owned by a different user, or a symlink to the directory of a different user. This can lead to disruption of confidentiality, integrity, and availability of protected information. The exploitation can be carried out by a local attacker who has passed the authentication procedure.
Recommendations For versions prior to 0.6.3, update to version 0.6.3 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2015-02585
CVE-2008-1614
DSA-1550-1
DTSA-124-1

Produtos afetados

Suphp