PT-2009-1082 · Gentoo Linux · Wicd

Tiziano Mueller · Publicado 2009-02-09 · Atualizado 2012-07-02 · CVE-2009-0489

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions wicd versions prior to 1.5.9

Description The issue concerns a problem with the wicd package in Gentoo Linux, where exploitation can lead to a breach of protected information confidentiality. This can be exploited locally. The DBus configuration file for Wicd allows arbitrary users to own org.wicd.daemon, enabling local users to receive messages intended for the Wicd daemon, possibly including credentials.

Recommendations For versions prior to 1.5.9, update to version 1.5.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the DBus configuration file to prevent arbitrary users from owning org.wicd.daemon.

Correção

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

BDU:2015-09380

CVE-2009-0489

Produtos afetados

Wicd

Referências · 8

• https://bdu.fstec.ru/vul/2015-09380 · Nota de Segurança
• http://sourceforge.net/project/shownotes.php?group_id=194573&release_id=659059 · Nota
• http://security.gentoo.org/glsa/glsa-200904-12.xml · Aviso do Fabricante
• http://secunia.com/advisories/33870 · Nota
• http://bazaar.launchpad.net/~wicd-devel/wicd/trunk/revision/222 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0489 · Nota de Segurança
• http://openwall.com/lists/oss-security/2009/02/06/4 · Nota
• http://secunia.com/advisories/34685 · Nota