PT-2008-6165 · Bk2Site · Bk2Site

Robert Buchholz · Publicado 2008-11-07 · Atualizado 2017-08-08 · CVE-2008-4995

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions bk2site version 1.1.9

Description The issue allows local users to overwrite arbitrary files via a symlink attack on the /tmp/redirect.log temporary file in the redirect.pl script. This is limited to debug mode, which is disabled by default.

Recommendations For bk2site version 1.1.9, consider disabling debug mode to prevent exploitation of this issue. As a temporary workaround, restrict access to the redirect.pl script and the /tmp/redirect.log file to minimize the risk of arbitrary file overwrites.

Exploit

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2008-4995

Produtos afetados

Bk2Site

Referências · 6

• 🔥 http://dev.gentoo.org/~rbu/security/debiantemp/bk2site · Exploit
• http://openwall.com/lists/oss-security/2008/10/30/2 · Nota
• http://bugs.debian.org/496430 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46543 · Nota
• https://bugs.gentoo.org/show_bug.cgi?id=235770 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-4995 · Nota de Segurança