PT-2008-1817 · Gforge · Gforge

Mark Hymers + 1 · Publicado 2008-05-18 · Atualizado 2017-08-08 · CVE-2008-0167

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GForge version 4.5.14

Description The issue is related to the write array file function in utils/include.pl, which updates configuration files by truncating them to zero length and then writing new data. This might allow attackers to bypass intended access restrictions or have unspecified other impact in opportunistic circumstances.

Recommendations For GForge version 4.5.14, consider modifying the write array file function to avoid truncating configuration files to zero length before writing new data, or apply alternative access control mechanisms to prevent potential bypass of intended restrictions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2008-0167

DSA-1577-1

Produtos afetados

Gforge

Referências · 9

• 🔥 https://exploit-db.com/exploits/5173 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0167 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42456 · Nota
• http://security.debian.org/pool/updates/main/g/gforge/gforge_4.5.14-22etch8.diff.gz · Nota
• http://secunia.com/advisories/30088 · Aviso do Fabricante
• http://debian.org/security/2008/dsa-1577 · Correção, Aviso do Fabricante
• http://vupen.com/english/advisories/2008/1537/references · Nota
• http://securityfocus.com/bid/29215 · Nota
• http://secunia.com/advisories/30286 · Aviso do Fabricante