PT-2008-1950 · Sco · Sco Unixware

Qaaz · Publicado 2008-04-07 · Atualizado 2017-09-29 · CVE-2008-0310

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SCO UnixWare version 7.1.4 before p534589

Description A directory traversal issue exists, allowing local users to create or append to arbitrary files. This is achieved by using ".." sequences in an unspecified environment variable, likely PKGINST, within the pkgadd environment.

Recommendations For SCO UnixWare version 7.1.4 before p534589, consider restricting access to the pkgadd command until a patch is available, specifically by limiting the ability to manipulate the environment variable that is being exploited.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-0310

Produtos afetados

Sco Unixware

Referências · 8

• 🔥 https://exploit-db.com/exploits/5355 · Exploit
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=676 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0310 · Nota de Segurança
• http://ftp.sco.com/pub/unixware7/714/security/p534589/p534589.txt · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41759 · Nota
• http://securitytracker.com/id?1019787 · Nota
• http://sco.com/support/update/download/release.php?rid=324 · Aviso do Fabricante
• http://secunia.com/advisories/29657 · Aviso do Fabricante