PT-2011-3671 · Fabric · Fabric

Jan Lieskovsky · Publicado 2011-07-27 · Atualizado 2022-05-17 · CVE-2011-2185

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Média

Vetor base

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Fabric versions prior to 1.1.0

Description The issue allows local users to overwrite arbitrary files via a symlink attack on certain files, including /tmp/fab.*.tar files or other files in the top level of /tmp/.

Recommendations For versions prior to 1.1.0, update to version 1.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the /tmp/ directory to minimize the risk of exploitation. Avoid using symlinks in the affected directory until the issue is resolved.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2011-2185

GHSA-XWG2-QC6C-7C3Q

Produtos afetados

Fabric

Referências · 17

• https://github.com/fabric/fabric · Nota
• https://github.com/fabric/fabric/commit/d7470d2db919ffcee80c245cf87e6d8d4ba6909c · Nota
• https://github.com/fabric/fabric/commit/3445b5653cd297039443110548fb3cab2e8e25af · Nota
• https://cve.org/CVERecord?id=CVE-2011-2185 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2011-2185 · Aviso do Fabricante
• http://code.fabfile.org/projects/fabric/files/Fabric-1.1.0.tar.gz · Correção
• https://osv.dev/vulnerability/UBUNTU-CVE-2011-2185 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2011/06/06/12 · Nota
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629003 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-2185 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-xwg2-qc6c-7c3q · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062534.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2011-2185 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=710462 · Nota
• https://security-tracker.debian.org/tracker/CVE-2011-2185 · Aviso do Fabricante