PT-2019-6557 · Gargoyle · Gargoyle

Publicado 2019-11-12 · Atualizado 2020-08-18 · CVE-2010-3359

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions gargoyle-free versions prior to 2009-08-25

Description The issue allows a local user to trick another user into running gargoyle in a directory with a cracked libgarglk.so, potentially gaining access to the user's account. This occurs when the LD LIBRARY PATH is undefined.

Recommendations For versions prior to 2009-08-25, define the LD LIBRARY PATH to prevent it from pointing to the current directory, or ensure that users are aware of the potential risk when running gargoyle in untrusted directories.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2010-3359

Produtos afetados

Gargoyle

Referências · 4

• https://osv.dev/vulnerability/DEBIAN-CVE-2010-3359 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-3359 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2010-3359 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2010-3359 · Aviso do Fabricante