PT-2008-4729 · Red Hat · Cygwin

Derek Callaway · Publicado 2008-07-28 · Atualizado 2018-10-11 · CVE-2008-3323

Positive Technologies (AI Summary)

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cygwin setup.exe version prior to 2.573.2.3

Description The issue is related to the improper verification of package authenticity, allowing remote Cygwin mirror servers or man-in-the-middle attackers to execute arbitrary code via a package list containing the MD5 checksum of a Trojan horse package.

Recommendations For Cygwin setup.exe version prior to 2.573.2.3, update to version 2.573.2.3 or later to resolve the issue. As a temporary workaround, consider verifying the authenticity of packages manually until a patch is applied. Restrict access to untrusted Cygwin mirror servers to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-3323

Produtos afetados

Cygwin

Referências · 10

• http://cygwin.com/ml/cygwin-announce/2008-08/msg00001.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44047 · Nota
• http://securityfocus.com/archive/1/494756/100/0/threaded · Nota
• http://securityreason.com/securityalert/4051 · Nota
• http://secunia.com/advisories/31271 · Nota
• http://security-objectives.com/advisories/SECOBJADV-2008-02.txt · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3323 · Nota de Segurança
• http://securityfocus.com/bid/30375 · Nota
• http://vupen.com/english/advisories/2008/2321 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=449929 · Nota