PT-2002-1282 · Oracle · Tarantella Enterprise 3

Published 2002-05-16 · Updated 2024-02-14 · CVE-2002-0211

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:L/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tarantella Enterprise 3 versions 3.01 through 3.20

Description A race condition exists in the installation script, which creates a world-writeable temporary "gunzip" program before executing it. This could allow local users to execute arbitrary commands by modifying the program before it is executed.

Recommendations For Tarantella Enterprise 3 versions 3.01 through 3.20, consider restricting access to the temporary directory where the "gunzip" program is created to prevent unauthorized modifications. As a temporary workaround, consider disabling the execution of the installation script until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2002-0211

Affected Products

Tarantella Enterprise 3

References · 7

• 🔥 https://exploit-db.com/exploits/21244 · Exploit
• 🔥 http://online.securityfocus.com/archive/1/265845 · Exploit
• http://iss.net/security_center/static/7996.php · Vendor Advisory
• http://tarantella.com/security/bulletin-04.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0211 · Security Note
• http://marc.info/?l=bugtraq&m=101208650722179&w=2 · Note
• http://securityfocus.com/bid/3966 · Note