PT-2009-1111 · Sblim+1 · Sblim-Sfcb+1
Marcus Meissner
·
Publicado
2009-02-03
·
Atualizado
2018-12-11
·
CVE-2009-0416
CVSS v2.0
6.9
Média
| Vetor | AV:L/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
sblim-sfcb version 1.3.2
Description
The issue is related to the SSL certificate setup program (genSslCert.sh) in sblim-sfcb, which allows local users to overwrite arbitrary files via a symlink attack on temporary files, including
/var/tmp/key.pem, /var/tmp/cert.pem, and /var/tmp/ssl.cnf. This vulnerability is associated with incorrect link resolution before file access, potentially allowing an attacker to access confidential data, compromise its integrity, and cause a denial of service.Recommendations
For version 1.3.2, consider restricting access to the
genSslCert.sh program to prevent local users from exploiting the symlink vulnerability until a patch is available. As a temporary workaround, monitor and restrict modifications to the /var/tmp/key.pem, /var/tmp/cert.pem, and /var/tmp/ssl.cnf files to minimize the risk of exploitation.Correção
Link Following
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Sblim-Sfcb