PT-2012-1499 · Gypsy · Gypsy

Kees Cook · Publicado 2012-08-13 · Atualizado 2013-12-13 · CVE-2011-0523

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions gypsy version 0.8

Description The issue allows local users to read otherwise restricted files due to improper restriction of files that can be read while running with root privileges.

Recommendations For version 0.8, restrict the use of gypsy when running with root privileges to minimize the risk of exploitation. Consider implementing additional access controls to limit the files that can be read by gypsy. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2011-0523

Produtos afetados

Gypsy

Referências · 11

• 🔥 http://cgit.freedesktop.org/gypsy/commit/?id=40101707cddb319481133b2a137294b6b669bd16 · Exploit
• http://openwall.com/lists/oss-security/2011/01/25/10 · Nota
• http://lists.opensuse.org/opensuse-updates/2012-07/msg00034.html · Aviso do Fabricante
• https://bugs.freedesktop.org/show_bug.cgi?id=33431 · Nota
• https://bugs.launchpad.net/ubuntu/+source/gypsy/+bug/690323 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106927.html · Aviso do Fabricante
• http://secunia.com/advisories/49991 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2011/01/24/10 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106919.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-0523 · Nota de Segurança
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107020.html · Aviso do Fabricante