PT-2010-4296 · Red Hat+1 · Spice+2

Petr Matousek · Publicado 2010-12-08 · Atualizado 2013-01-16 · CVE-2010-2793

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Virtualization (RHEV) Manager versions prior to 2.2.4

Description The issue involves a race condition in the SPICE plug-in for Internet Explorer, allowing local users to create a specific named pipe and gain privileges. This is achieved through knowledge of the named pipe's name and the use of the ImpersonateNamedPipeClient function.

Recommendations For versions prior to 2.2.4, update to version 2.2.4 or later to resolve the issue.

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2010-2793

Produtos afetados

Internet Explorer

Red Hat Enterprise Virtualization

Spice

Referências · 5

• https://rhn.redhat.com/errata/RHSA-2010-0818.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-2793 · Nota de Segurança
• http://securityfocus.com/bid/45213 · Nota
• http://securitytracker.com/id?1024825 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=620355 · Nota