PT-2010-4416 · Oracle · Hsolink

Publicado 2010-08-02 · Atualizado 2017-08-17 · CVE-2010-2929

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions hsolink version 1.0.118

Description The issue allows local users to gain privileges via a modified PATH environment variable. This is exploited during the execution of certain programs, including route, mv, and cp.

Recommendations For hsolink version 1.0.118, consider restricting the modification of the PATH environment variable to prevent privilege escalation. As a temporary workaround, restrict access to the route, mv, and cp programs until a patch is available.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-2929

Produtos afetados

Hsolink

Referências · 5

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590670 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/60877 · Nota
• http://ftp.de.debian.org/debian/pool/main/h/hsolink/hsolink_1.0.118.orig.tar.gz · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-2929 · Nota de Segurança
• http://osvdb.org/66837 · Nota