PT-2001-1039 · Tcllib+2 · Tcllib+2

Published 2001-07-19 · Updated 2008-09-05 · CVE-2001-1375

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions tcl/tk package (tcltk) version 8.3.1 tcltk-8.3.3 tclx-8.3 tcllib-1.0 tcl-8.3.3

Description The issue allows local users to execute arbitrary code via a Trojan horse library that is under a user-controlled directory. Multiple vulnerabilities in the tcltk package could lead to a disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited locally.

Recommendations For tcl/tk package (tcltk) version 8.3.1, consider updating to a version where the library search path prioritizes system directories over the current working directory. For tcltk-8.3.3, tclx-8.3, tcllib-1.0, and tcl-8.3.3, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-07966

BDU:2015-07967

BDU:2015-07968

BDU:2015-07969

CVE-2001-1375

Affected Products

Tcltk

Tcllib

Tclx

References · 12

• http://mandrakesoft.com/security/advisories?name=MDKSA-2002:060 · Vendor Advisory
• http://iss.net/security_center/static/6869.php · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07966 · Security Note
• https://bdu.fstec.ru/vul/2015-07969 · Security Note
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000409 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07968 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2001-1375 · Security Note
• https://bdu.fstec.ru/vul/2015-07967 · Security Note
• http://securityfocus.com/bid/3073 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2002-148.html · Vendor Advisory
• https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=28226 · Note
• https://rhn.redhat.com/errata/RHSA-2002-148.html · Note