PT-2012-2925 · Paste+2 · Paste Script+2

Jan Lieskovsky · Publicado 2012-05-01 · Atualizado 2022-05-17 · CVE-2012-0878

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Paste Script versions 1.7.5 and earlier

Description The issue arises from improper handling of group memberships during execution with root privileges. This could allow remote attackers to bypass intended file-access restrictions by exploiting a web application that utilizes the local filesystem.

Recommendations For Paste Script versions 1.7.5 and earlier, update to a version that properly sets group memberships during execution with root privileges to prevent attackers from bypassing file-access restrictions.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CESA-2012_1206

CVE-2012-0878

GHSA-27PX-QPMJ-QG38

PYSEC-2012-15

RHSA-2012:1206

RHSA-2012_1206

Produtos afetados

Centos

Paste Script

Red Hat

Referências · 29

• https://github.com/pypa/advisory-database/tree/main/vulns/paste/PYSEC-2012-15.yaml · Nota
• https://github.com/cdent/pastescript/commit/b5f36f2995e1ae117cc53d2bd458d7fb33e4cabe · Nota
• https://github.com/pasteorg/pastescript · Nota
• https://bitbucket.org/ianb/pastescript/pull-request/3/fix-group-permissions-for-pastescriptserve · Correção
• https://web.archive.org/web/20140723093519/http://secunia.com/advisories/50410 · Nota
• http://openwall.com/lists/oss-security/2012/02/23/4 · Nota
• http://rhn.redhat.com/errata/RHSA-2012-1206.html · Aviso do Fabricante
• https://rhn.redhat.com/errata/RHSA-2012-1206.html · Nota
• https://lists.centos.org/pipermail/centos-announce/2012-August/055746.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0878 · Nota de Segurança
• https://lists.centos.org/pipermail/centos-announce/2012-August/068302.html · Nota
• http://secunia.com/advisories/48812 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=796790 · Nota
• https://bitbucket.org/ianb/pastescript/changeset/a19e462769b4 · Correção
• https://osv.dev/vulnerability/GHSA-27px-qpmj-qg38 · Aviso do Fabricante