PT-2008-4664 · Ibm+4 · Aix+4

Publicado 2008-10-21 · Atualizado 2018-10-11 · CVE-2008-3248

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Symantec Veritas File System (VxFS) versions prior to 5.0 MP3 on Solaris, Linux, and AIX Symantec Veritas File System (VxFS) on HP-UX

Description: The issue concerns the Quick I/O for Database feature in Symantec Veritas File System (VxFS), where the qiomkfile does not properly initialize filesystem blocks during file creation. This allows local users to access sensitive information by creating and then reading files.

Recommendations: For Symantec Veritas File System (VxFS) versions prior to 5.0 MP3 on Solaris, Linux, and AIX, update to version 5.0 MP3 or later. For Symantec Veritas File System (VxFS) on HP-UX, consider restricting access to the Quick I/O for Database feature until a patch is available. As a temporary workaround, consider disabling the Quick I/O for Database feature to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2008-3248

Produtos afetados

Aix

Hp-Ux

Linux

Solaris

Symantec Veritas File System

Referências · 11

• http://securityfocus.com/archive/1/497626/100/0/threaded · Nota
• http://security-objectives.com/advisories/SECOBJADV-2008-04.txt · Nota
• http://securityfocus.com/bid/31678 · Nota
• http://secunia.com/advisories/32332 · Nota
• http://symantec.com/avcenter/security/Content/2008.10.20.html · Aviso do Fabricante
• http://security-objectives.com/advisories/SECOBJSADV-2008-04.txt · Nota
• http://seer.entsupport.symantec.com/docs/310872.htm · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/2875 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3248 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46008 · Nota
• http://securitytracker.com/id?1021074 · Nota