PT-2008-1490 · Red Hat · Setroubleshoot+1

Publicado 2008-05-20 · Atualizado 2017-09-29 · CVE-2007-5496

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions setroubleshoot version 2.0.5

Description A cross-site scripting (XSS) issue allows local users to inject arbitrary web script or HTML via a crafted file or process name. This triggers an Access Vector Cache (AVC) log entry in a log file used during composition of HTML documents for sealert.

Recommendations For setroubleshoot version 2.0.5, consider restricting access to the log files used by sealert to minimize the risk of exploitation. As a temporary workaround, avoid using crafted file or process names that could trigger an AVC log entry until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-5496

RHSA-2008:0061

RHSA-2008_0061

Produtos afetados

Red Hat

Setroubleshoot

Referências · 11

• https://bugzilla.redhat.com/show_bug.cgi?id=288271 · Nota
• https://access.redhat.com/errata/RHSA-2008:0061 · Nota
• http://securitytracker.com/id?1020078 · Correção
• https://access.redhat.com/security/cve/CVE-2007-5496 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5496 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42592 · Nota
• http://securityfocus.com/bid/29324 · Nota
• http://secunia.com/advisories/30339 · Nota
• https://access.redhat.com/security/cve/CVE-2007-5495 · Nota
• http://redhat.com/support/errata/RHSA-2008-0061.html · Correção, Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10455 · Nota