PT-2016-4889 · Novell · Novell Filr

W. Ettlinger · Publicado 2016-08-01 · Atualizado 2017-09-03 · CVE-2016-1611

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Novell Filr versions 1.2 before Hot Patch 6 Novell Filr versions 2.0 before Hot Patch 2

Description The issue allows local users to gain privileges by replacing the content of a specific file with arbitrary shell commands, due to world-writable permissions for /etc/profile.d/vainit.sh.

Recommendations For Novell Filr version 1.2, apply Hot Patch 6 to resolve the issue. For Novell Filr version 2.0, apply Hot Patch 2 to resolve the issue. As a temporary workaround, consider restricting write access to the /etc/profile.d/vainit.sh file until a patch is applied.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2016-1611

Produtos afetados

Novell Filr

Referências · 6

• 🔥 https://exploit-db.com/exploits/40161 · Exploit
• https://novell.com/support/kb/doc.php?id=7017689 · Nota
• http://seclists.org/bugtraq/2016/Jul/119 · Nota
• https://osv.dev/vulnerability/CVE-2016-1611 · Aviso do Fabricante
• http://securityfocus.com/bid/92113 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-1611 · Nota de Segurança