PT-2008-1490 · Red Hat · Setroubleshoot+1

Published 2008-05-20 · Updated 2017-09-29 · CVE-2007-5496

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions setroubleshoot version 2.0.5

Description A cross-site scripting (XSS) issue allows local users to inject arbitrary web script or HTML via a crafted file or process name. This triggers an Access Vector Cache (AVC) log entry in a log file used during composition of HTML documents for sealert.

Recommendations For setroubleshoot version 2.0.5, consider restricting access to the log files used by sealert to minimize the risk of exploitation. As a temporary workaround, avoid using crafted file or process names that could trigger an AVC log entry until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-5496

RHSA-2008:0061

RHSA-2008_0061

Affected Products

Red Hat

Setroubleshoot

References · 11

• http://securitytracker.com/id?1020078 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-5496 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=288271 · Note
• https://access.redhat.com/errata/RHSA-2008:0061 · Note
• https://access.redhat.com/security/cve/CVE-2007-5496 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42592 · Note
• http://securityfocus.com/bid/29324 · Note
• http://secunia.com/advisories/30339 · Note
• https://access.redhat.com/security/cve/CVE-2007-5495 · Note
• http://redhat.com/support/errata/RHSA-2008-0061.html · Patch, Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10455 · Note