PT-2013-1558 · Emc · Emc Avamar Plugin For Oracle+1

Publicado 2013-01-21 · Atualizado 2013-01-22 · CVE-2012-2291

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions EMC Avamar Client versions 4.x through 6.x EMC Avamar plugin versions 4.x through 6.x for Oracle

Description The issue allows local users to gain privileges via an unspecified symlink attack due to world-writable permissions for cache directories.

Recommendations For EMC Avamar Client versions 4.x through 6.x, consider changing the permissions of the cache directories to prevent world-writable access until a patch is available. For EMC Avamar plugin versions 4.x through 6.x for Oracle, restrict access to the cache directories to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-2291

Produtos afetados

Emc Avamar Client

Emc Avamar Plugin For Oracle

Referências · 2

• http://archives.neohapsis.com/archives/bugtraq/2013-01/0086.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-2291 · Nota de Segurança