PT-2010-3646 · Wolfram Research · Mathematica

Paul Szabo · Publicado 2010-05-24 · Atualizado 2018-10-10 · CVE-2010-2027

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mathematica version 7

Description The issue allows local users to overwrite arbitrary files via a symlink attack on files within /tmp/MathLink/ or /tmp/fonts$$.conf when running on Linux.

Recommendations For Mathematica version 7, consider restricting access to the /tmp/MathLink/ directory and the /tmp/fonts$$.conf file to prevent a symlink attack until a patch is available.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2010-2027

Produtos afetados

Mathematica

Referências · 4

• http://marc.info/?l=full-disclosure&m=127380255201760&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-2027 · Nota de Segurança
• http://securityfocus.com/archive/1/511298/100/0/threaded · Nota
• http://secunia.com/advisories/39805 · Aviso do Fabricante