PT-2005-1055 · Common Lisp · Common-Lisp-Controller

Published 2005-09-16 · Updated 2017-07-11 · CVE-2005-2657

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions common-lisp-controller versions 4.18 and earlier

Description The issue allows local users to gain privileges by compiling arbitrary code in the cache directory. This code is executed by another user if the user has not run Common Lisp before. Multiple vulnerabilities in the common-lisp-controller package may lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited by a local attacker.

Recommendations For common-lisp-controller versions 4.18 and earlier, consider restricting access to the cache directory to prevent arbitrary code compilation until a fix is available. As a temporary workaround, consider disabling the compilation of code in the cache directory for users who have not run Common Lisp before, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-04091

CVE-2005-2657

DSA-811-2

Affected Products

Common-Lisp-Controller

References · 8

• http://debian.org/security/2005/dsa-811 · Vendor Advisory
• http://securityfocus.com/bid/14829 · Patch
• https://bdu.fstec.ru/vul/2015-04091 · Security Note
• http://secunia.com/advisories/16822 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2657 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2005-2657 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22275 · Note
• http://debian.org/security/dsa-811 · Note