PT-2009-3046 · Enomaly · Enomaly Elastic Computing Platform

Publicado 2009-02-02 · Atualizado 2018-10-11 · CVE-2009-0390

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Enomaly Elastic Computing Platform (ECP) versions prior to 2.1.1

Description The issue allows local users to send signals to arbitrary processes by populating the /tmp/enomalism2.pid file with command-line arguments for the kill program. This is due to an argument injection vulnerability.

Recommendations For versions prior to 2.1.1, update to version 2.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /tmp/enomalism2.pid file to prevent malicious population of command-line arguments.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-0390

Produtos afetados

Enomaly Elastic Computing Platform

Referências · 3

• 🔥 https://exploit-db.com/exploits/8067 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0390 · Nota de Segurança
• http://securityfocus.com/archive/1/500573/100/0/threaded · Nota