PT-2011-1506 · Gnu · Gnash

Jakub Wilk · Publicado 2011-01-14 · Atualizado 2012-06-19 · CVE-2010-4337

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Baixa

Vetor base

AV:L/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions gnash version 0.8.8

Description The issue allows local users to overwrite arbitrary files via a symlink attack on temporary files created by the configure script. Specifically, the attack targets the /tmp/gnash-configure-errors.$$, /tmp/gnash-configure-warnings.$$, or /tmp/gnash-configure-recommended.$$ files.

Recommendations For gnash version 0.8.8, consider restricting access to the configure script to prevent unauthorized modifications, and avoid using the script in environments where local users could exploit this issue. As a temporary workaround, consider monitoring and restricting access to the mentioned temporary files until a patch is available.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2010-4337

DSA-2435-1

Produtos afetados

Gnash

Referências · 10

• https://osv.dev/vulnerability/UBUNTU-CVE-2010-4337 · Aviso do Fabricante
• http://secunia.com/advisories/48466 · Nota
• http://secunia.com/advisories/42416 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-4337 · Nota de Segurança
• http://debian.org/security/2012/dsa-2435 · Aviso do Fabricante
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=605419 · Nota
• http://osvdb.org/69533 · Nota
• https://ubuntu.com/security/CVE-2010-4337 · Aviso do Fabricante
• http://securityfocus.com/bid/45102 · Nota
• https://cve.org/CVERecord?id=CVE-2010-4337 · Nota de Segurança