PT-2009-5612 · Gforge · Gforge

Sylvain Beucler · Publicado 2009-12-04 · Atualizado 2009-12-07 · CVE-2009-3304

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Baixa

Vetor base

AV:L/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions GForge versions 4.5.14, 4.7 rc2, 4.8.2

Description The issue allows local users to overwrite arbitrary files via a symlink attack on authorized keys files in users' home directories. This is related to the deb-specific/ssh dump update.pl and cronjobs/cvs-cron/ssh create.php scripts.

Recommendations For version 4.5.14, consider restricting access to the ssh dump update.pl script until a fix is available. For version 4.7 rc2, avoid using the ssh create.php script in cronjobs/cvs-cron until the issue is resolved. For version 4.8.2, as a temporary workaround, consider disabling the execution of cronjobs/cvs-cron/ssh create.php to minimize the risk of exploitation.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2009-3304

DSA-1945-1

Produtos afetados

Gforge

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2009-3304 · Nota de Segurança
• http://securityfocus.com/bid/37195 · Correção
• http://security.debian.org/pool/updates/main/g/gforge/gforge_4.5.14-22etch13.diff.gz · Correção
• http://debian.org/security/2009/dsa-1945 · Correção, Aviso do Fabricante