PT-2010-1147 · Gnustep · Gnustep-Base

Dan Rosenberg + 1 · Publicado 2010-05-12 · Atualizado 2014-01-20 · CVE-2010-1457

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions gnustep-base versions prior to 1.20.1

Description The issue concerns multiple vulnerabilities in the gnustep-base package that can lead to breaches in confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited locally. Specifically, a flaw in Tools/gdomap.c in gdomap in GNUstep Base before version 1.20.0 allows local users to read arbitrary files via certain options, which prints file contents in an error message.

Recommendations For versions prior to 1.20.1, update to version 1.20.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the gdomap tool until a patch is available.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2015-09691

CVE-2010-1457

Produtos afetados

Gnustep-Base

Referências · 17

• 🔥 http://securityfocus.com/bid/40005 · Exploit
• 🔥 https://bugs.launchpad.net/ubuntu/+source/gnustep-base/+bug/573108 · Exploit
• 🔥 https://exploit-db.com/exploits/33963 · Exploit
• https://cve.org/CVERecord?id=CVE-2010-1457 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2010-1457 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-09691 · Nota de Segurança
• http://openwall.com/lists/oss-security/2010/05/07/6 · Nota
• https://osv.dev/vulnerability/CVE-2010-1457 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2010-1457 · Aviso do Fabricante
• http://thread.gmane.org/gmane.comp.lib.gnustep.bugs/12336 · Nota
• http://security.gentoo.org/glsa/glsa-201401-12.xml · Nota
• http://secunia.com/advisories/39746 · Aviso do Fabricante
• http://savannah.gnu.org/bugs/?29755 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-1457 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2010-1457 · Aviso do Fabricante