PT-2008-1031 · Debian · Hf+1

Steve Kemp · Publicado 2008-11-26 · Atualizado 2017-08-08 · CVE-2008-2378

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions hf versions 0.7.3 through 0.8

Description The issue concerns multiple vulnerabilities in the hf package of the Debian GNU/Linux operating system, which can be exploited by a local attacker to compromise the confidentiality, integrity, and availability of protected information. A specific vulnerability exists in the hfkernel, where improper handling of the -k option allows local users to gain privileges via a Trojan horse killall program in a directory in the PATH.

Recommendations For versions 0.7.3 through 0.8, consider restricting access to the killall program to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the -k option in the hfkernel until the issue is resolved.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2015-02618

CVE-2008-2378

DSA-1668-1

Produtos afetados

Debian

Hf

Referências · 11

• http://debian.org/security/dsa-1668 · Nota
• https://bdu.fstec.ru/vul/2015-02618 · Nota de Segurança
• http://secunia.com/advisories/32831 · Aviso do Fabricante
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504182 · Nota
• http://osvdb.org/50231 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2378 · Nota de Segurança
• http://securityfocus.com/bid/32421 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46806 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2378 · Nota de Segurança
• http://secunia.com/advisories/32855 · Aviso do Fabricante
• http://debian.org/security/2008/dsa-1668 · Correção, Aviso do Fabricante