PT-2011-3476 · Netbsd · Netbsd+1

Vincent Danen · Publicado 2011-05-23 · Atualizado 2017-08-17 · CVE-2011-1920

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Baixa

Vetor base

AV:L/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions NetBSD versions prior to 1.6.2 pmake version 1.111

Description The issue allows local users to overwrite arbitrary files via a symlink attack on a /tmp/ depend temporary file. This is related to the bsd.lib.mk and bsd.prog.mk include files.

Recommendations For NetBSD versions prior to 1.6.2, update to version 1.6.2 or later to resolve the issue. For pmake version 1.111, consider restricting access to temporary files in /tmp to minimize the risk of exploitation until a patch is available.

Exploit

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2011-1920

MGASA-2013-0331

Produtos afetados

Netbsd

Pmake

Referências · 14

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=705090 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2011/05/16/2 · Exploit
• 🔥 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=626673 · Exploit
• https://advisories.mageia.org/MGASA-2013-0331.html · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=705100 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67495 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1920 · Nota de Segurança
• https://osv.dev/vulnerability/MGASA-2013-0331 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=11556 · Nota
• http://gentoo.org/security/en/glsa/glsa-201310-17.xml · Nota
• http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.lib.mk.diff?r1=1.239&r2=1.240&f=h · Correção
• http://openwall.com/lists/oss-security/2011/05/16/8 · Correção
• http://securityfocus.com/bid/47878 · Nota
• http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.prog.mk.diff?r1=1.192&r2=1.193&f=h · Correção