PT-2005-4186 · Ntop · Ntop

Published 2005-11-01 · Updated 2011-03-08 · CVE-2005-3387

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ntop versions prior to 3.2

Description The issue arises from the startup script in packages/RedHat/ntop.init, which creates temporary files insecurely when ntop.conf is writable by users besides root. This allows remote attackers to execute arbitrary code.

Recommendations For versions prior to 3.2, ensure that ntop.conf is only writable by the root user to prevent exploitation. As a temporary workaround, consider restricting access to the startup script in packages/RedHat/ntop.init until a patch is available.

Fix

Related Identifiers

CVE-2005-3387

Affected Products

Ntop

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2005-3387 · Security Note
• http://secunia.com/advisories/17382 · Vendor Advisory
• http://securityfocus.com/bid/15242 · Patch
• http://listgateway.unipi.it/pipermail/ntop-dev/2005-March/005296.html · Vendor Advisory
• http://vupen.com/english/advisories/2005/2251 · Note