PT-2000-1713 · Ca · Arcserveit Client Agent

Published 2000-10-20 · Updated 2017-10-10 · CVE-2000-0781

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ARCServeIT Client Agent version 6.62

Description The issue arises from the uagentsetup in ARCServeIT Client Agent, which fails to properly check for the existence or ownership of a temporary file. This temporary file is later moved to the agent.cfg configuration file. As a result, local users can execute arbitrary commands by modifying the temporary file before it is moved.

Recommendations For ARCServeIT Client Agent version 6.62, consider restricting access to the temporary file used by uagentsetup to prevent unauthorized modifications until a patch is available. Additionally, monitor the agent.cfg configuration file for any suspicious changes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2000-0781

Affected Products

Arcserveit Client Agent

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2000-0781 · Security Note
• http://securityfocus.com/bid/1519 · Vendor Advisory
• http://archives.neohapsis.com/archives/bugtraq/2000-07/0431.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5023 · Note