PT-2003-1039 · Noweb · Noweb

Published 2003-06-20 · Updated 2008-09-05 · CVE-2003-0381

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions noweb versions 2.9 and earlier

Description The issue concerns multiple vulnerabilities in the noweb package that can lead to the compromise of protected information integrity. A local attacker can exploit these vulnerabilities. Technical details include the insecure creation of temporary files, allowing local users to overwrite arbitrary files through multiple vectors, including the noroff script.

Recommendations For noweb versions 2.9 and earlier, consider restricting access to the noroff script until a patch is available. As a temporary workaround, avoid using the noweb package for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-04108

CVE-2003-0381

DSA-323

Affected Products

Noweb

References · 8

• https://bdu.fstec.ru/vul/2015-04108 · Security Note
• http://debian.org/security/2003/dsa-323 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2003-0381 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0381 · Security Note
• https://osv.dev/vulnerability/CVE-2003-0381 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0381 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0381 · Security Note
• http://debian.org/security/dsa-323 · Note