PT-2015-3191 · Zarafa · Zarafa Collaboration Platform

Publicado 2015-06-09 · Atualizado 2016-12-06 · CVE-2015-3436

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Média

Vetor base

AV:L/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zarafa Collaboration Platform versions prior to 7.1.13 Zarafa Collaboration Platform versions 7.2.x prior to 7.2.1

Description The issue is related to a file access control flaw in the provider/server/ECServer.cpp component. It allows local users to manipulate symbolic links and write to arbitrary files. This can be achieved through a symlink attack on /tmp/zarafa-upgrade-lock.

Recommendations For Zarafa Collaboration Platform versions prior to 7.1.13, update to version 7.1.13 or later. For Zarafa Collaboration Platform versions 7.2.x prior to 7.2.1, update to version 7.2.1 or later.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

BDU:2016-00561

CVE-2015-3436

Produtos afetados

Zarafa Collaboration Platform

Referências · 6

• http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159455.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-3436 · Nota de Segurança
• https://jira.zarafa.com/browse/ZCP-13282 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159497.html · Aviso do Fabricante
• http://securityfocus.com/bid/75104 · Nota
• https://bdu.fstec.ru/vul/2016-00561 · Nota de Segurança