PT-2012-6307 · Golismero · Golismero

Publicado 2012-03-19 · Atualizado 2012-03-19

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions GoLismero versions prior to Git revision 2b3bb43d6867

Description The issue allows local users to overwrite arbitrary files via a symlink attack on GoLismero-controlled files. This can be demonstrated using the Admin/changes.dat file.

Recommendations For GoLismero versions prior to Git revision 2b3bb43d6867, consider updating to a version that includes the fix for this issue, specifically Git revision 2b3bb43d6867 or later. As a temporary workaround, restrict access to the libs/updater.py file to minimize the risk of exploitation. Avoid using the Admin/changes.dat file in a way that could be exploited by the vulnerability until the issue is resolved.

Identificadores relacionados

PYSEC-2012-31

Produtos afetados

Golismero

Referências · 5

• http://openwall.com/lists/oss-security/2012/01/17/7 · Nota
• http://osvdb.org/78472 · Nota
• http://openwall.com/lists/oss-security/2012/01/17/10 · Nota
• http://code.google.com/p/golismero/source/detail?r=2b3bb43d68676efd687361f7de29380189031ab8 · Nota
• https://osv.dev/vulnerability/PYSEC-2012-31 · Aviso do Fabricante