PT-2010-4426 · Slim · Slim

Niels Heinen · Publicado 2010-08-30 · Atualizado 2010-08-31 · CVE-2010-2945

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SLiM versions prior to 1.3.2

Description The issue is related to the default configuration of SLiM, where the default path option in slim.conf starts with ./ (dot slash), potentially allowing local users to gain privileges via a Trojan horse program in the current working directory. This is related to the cfg.cpp file.

Recommendations For versions prior to 1.3.2, update to version 1.3.2 or later to resolve the issue. As a temporary workaround, consider modifying the default path option in slim.conf to remove the ./ (dot slash) at the beginning, or restrict access to the slim.conf file to prevent modifications.

Correção

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

CVE-2010-2945

Produtos afetados

Slim

Referências · 8

• https://osv.dev/vulnerability/DEBIAN-CVE-2010-2945 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2010/08/19/8 · Nota
• http://svn.berlios.de/viewvc/slim?view=revision&revision=171 · Nota
• https://security-tracker.debian.org/tracker/CVE-2010-2945 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2010-2945 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2010/08/20/10 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-2945 · Nota de Segurança
• http://secunia.com/advisories/41005 · Aviso do Fabricante