PT-2003-2224 · Insightful · S-Plus

Published 2003-12-31 · Updated 2008-09-05 · CVE-2003-1279

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions S-PLUS version 6.0

Description The issue allows local users to overwrite arbitrary files and possibly elevate privileges via a symlink attack on several temporary files created by various components, including Sqpe, PRINT, mustfix.hlinks, sas get, sas vars, and sglm2html. The affected files include /tmp/ F8499, /tmp/PRINT.$$.out, /tmp/SUBST$PID.TXT, /tmp/ed.cmds$PID, /tmp/file.1, /tmp/file.2, /tmp/sgml2html$$tmp, /tmp/sgml2html$$tmp1, and /tmp/sgml2html$$tmp2.

Recommendations For S-PLUS version 6.0, consider restricting access to the temporary files and directories used by the affected components to minimize the risk of exploitation. As a temporary workaround, avoid using the affected components until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2003-1279

Affected Products

S-Plus

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2003-1279 · Security Note
• http://securityfocus.com/archive/1/305342 · Vendor Advisory
• http://secunia.com/advisories/7833 · Note
• http://securitytracker.com/id?1005896 · Note
• http://securityfocus.com/bid/6530 · Note
• http://iss.net/security_center/static/11005.php · Note