PT-2011-1115 · Mozilla+1 · Spice Firefox Plug-In+1
Petr Matousek
·
Publicado
2011-04-07
·
Atualizado
2024-03-12
·
CVE-2011-0012
CVSS v2.0
5.1
Média
| Vetor | AV:N/AC:H/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
SPICE Firefox plug-in (spice-xpi) versions 2.2 through 2.4
Description
The issue allows local users to overwrite arbitrary files via a symlink attack on the usbrdrctl log file, which has a predictable name. Multiple vulnerabilities in the spice-xpi package may lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely.
Recommendations
For versions 2.2 through 2.4, consider restricting access to the usbrdrctl log file to prevent symlink attacks until a patch is available.
As a temporary workaround, consider disabling the spice-xpi plug-in until a fix is provided to prevent potential exploitation of the vulnerabilities.
Correção
Link Following
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Red Hat
Spice Firefox Plug-In