PT-2008-6112 · Aegis · Aegis-Web+1

Publicado

2008-11-05

·

Atualizado

2017-08-08

·

CVE-2008-4938

CVSS v2.0

6.9

Média

VetorAV:L/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions aegis version 4.24 aegis-web version 4.24
Description The issue allows local users to overwrite arbitrary files via a symlink attack on various temporary files, including /tmp/#####, /tmp/#####.intro, /tmp/aegis.#####.ae, /tmp/aegis.#####, /tmp/aegis.#####.1, /tmp/aegis.#####.2, /tmp/aegis.#####.log, and /tmp/aegis.#####.out. This is related to the bng dvlpd.sh, bng rvwd.sh, awt dvlp.sh, awt intgrtn.sh, and aegis.cgi scripts.
Recommendations For aegis version 4.24, consider restricting access to the temporary files in /tmp to prevent symlink attacks until a patch is available. For aegis-web version 4.24, restrict access to the temporary files in /tmp to minimize the risk of exploitation.

Exploit

Correção

Link Following

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2008-4938

Produtos afetados

Aegis
Aegis-Web