PT-2009-4354 · Red Hat · Dhcpd+1

Robert Vogelgesang · Publicado 2009-07-17 · Atualizado 2023-02-13 · CVE-2009-1893

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Red Hat dhcpd version 3.0.1 in Red Hat Enterprise Linux (RHEL) 3

Description: The issue allows local users to overwrite arbitrary files via a symlink attack on a temporary file, related to the dhcpd init script's configtest function and the "dhcpd -t" command.

Recommendations: For Red Hat dhcpd version 3.0.1 in Red Hat Enterprise Linux (RHEL) 3, consider restricting access to the configtest function in the dhcpd init script to prevent local users from overwriting arbitrary files until a fix is available.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2009-1893

RHSA-2009:1154

Produtos afetados

Red Hat

Dhcpd

Referências · 9

• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6440 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-1893 · Nota de Segurança
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11597 · Nota
• http://securityfocus.com/bid/35670 · Nota
• http://redhat.com/support/errata/RHSA-2009-1154.html · Aviso do Fabricante
• http://secunia.com/advisories/35831 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=510024 · Nota
• http://securitytracker.com/id?1022554 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51718 · Nota