PT-2011-2842 · Rapid7 · Metasploit Framework

Publicado 2011-02-21 · Atualizado 2011-06-20 · CVE-2011-1056

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Média

Vetor base

AV:L/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Metasploit Framework version 3.5.1

Description The issue concerns the installer for the Metasploit Framework, which, when running on Windows, uses weak inherited permissions for the Metasploit installation directory. This weakness allows local users to gain privileges by replacing critical files with a Trojan horse.

Recommendations For Metasploit Framework version 3.5.1, consider restricting access to the Metasploit installation directory to prevent local users from replacing critical files until a fix is available.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2011-1056

Produtos afetados

Metasploit Framework

Referências · 6

• http://vupen.com/english/advisories/2011/0371 · Aviso do Fabricante
• http://secunia.com/advisories/43166 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1056 · Nota
• http://blog.metasploit.com/2011/02/metasploit-framework-352-released.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1056 · Nota de Segurança
• http://osvdb.org/70857 · Nota