PT-2011-1201 · Gnu · Groff

Nico Golde · Publicado 2011-06-30 · Atualizado 2013-10-25 · CVE-2009-5082

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions groff versions prior to 1.22.2

Description The issue concerns the improper creation of temporary files by the configure and config.guess scripts in groff, which can be exploited by local users to overwrite arbitrary files via a symlink attack. Multiple vulnerabilities in the groff package can lead to a breach of integrity and availability of protected information, and exploitation can be carried out remotely.

Recommendations For versions prior to 1.22.2, update to version 1.22.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the configure and config.guess scripts until a patch is available.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

BDU:2015-09687

CVE-2009-5082

Produtos afetados

Groff

Referências · 10

• https://nvd.nist.gov/vuln/detail/CVE-2009-5082 · Nota de Segurança
• http://security.gentoo.org/glsa/glsa-201310-14.xml · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-5082 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2009-5082 · Aviso do Fabricante
• http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff · Correção
• http://openwall.com/lists/oss-security/2009/08/14/5 · Correção
• https://bdu.fstec.ru/vul/2015-09687 · Nota de Segurança
• http://openwall.com/lists/oss-security/2009/08/14/4 · Correção
• https://osv.dev/vulnerability/CVE-2009-5082 · Aviso do Fabricante
• http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff.diff?r1=1.1%3Br2=1.2%3Bf=h · Nota