PT-2012-2038 · Par · Par

Publicado 2012-01-13 · Atualizado 2017-08-29 · CVE-2011-5060

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Baixa

Vetor base

AV:L/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions PAR module versions prior to 1.003

Description The issue concerns the par mktmpdir function in the PAR module, which creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory. This allows local users to overwrite files when another user extracts a PAR packed program.

Recommendations For PAR module versions prior to 1.003, update to version 1.003 or later to resolve the issue. As a temporary workaround, consider restricting access to the temporary directory used by the par mktmpdir function to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2011-5060

Produtos afetados

Par

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2011-5060 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2011-5060 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-5060 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2011-5060 · Aviso do Fabricante
• http://cpansearch.perl.org/src/RSCHUPP/PAR-1.003/ChangeLog · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=753955 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72435 · Nota
• https://rt.cpan.org/Public/Bug/Display.html?id=69560 · Nota