PT-2000-1000 · Gnu · Ed

Published 2000-12-06 · Updated 2018-05-03 · CVE-2000-1137

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ed versions prior to 0.2-18.1

Description The issue allows local users to overwrite the files of other users via a symlink attack, potentially leading to violations of confidentiality, integrity, and availability of protected information. This can be exploited by a local attacker.

Recommendations For versions prior to 0.2-18.1, update to version 0.2-18.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the ed package to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-03573

BDU:2015-07793

CVE-2000-1137

Affected Products

Ed

References · 11

• https://bdu.fstec.ru/vul/2015-03573 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2000-1137 · Security Note
• http://redhat.com/support/errata/RHSA-2000-123.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1137 · Security Note
• https://bdu.fstec.ru/vul/2015-07793 · Security Note
• http://debian.org/security/2000/20001129 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5723 · Note
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000359 · Note
• http://linux-mandrake.com/en/security/MDKSA-2000-076.php3 · Note
• http://osvdb.org/6491 · Note
• https://rhn.redhat.com/errata/RHSA-2000-123.html · Note