PT-2008-1817 · Gforge · Gforge

Mark Hymers + 1 · Published 2008-05-18 · Updated 2017-08-08 · CVE-2008-0167

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GForge version 4.5.14

Description The issue is related to the write array file function in utils/include.pl, which updates configuration files by truncating them to zero length and then writing new data. This might allow attackers to bypass intended access restrictions or have unspecified other impact in opportunistic circumstances.

Recommendations For GForge version 4.5.14, consider modifying the write array file function to avoid truncating configuration files to zero length before writing new data, or apply alternative access control mechanisms to prevent potential bypass of intended restrictions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2008-0167

DSA-1577-1

Affected Products

Gforge

References · 9

• 🔥 https://exploit-db.com/exploits/5173 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-0167 · Security Note
• http://secunia.com/advisories/30088 · Vendor Advisory
• http://secunia.com/advisories/30286 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42456 · Note
• http://security.debian.org/pool/updates/main/g/gforge/gforge_4.5.14-22etch8.diff.gz · Note
• http://debian.org/security/2008/dsa-1577 · Patch, Vendor Advisory
• http://vupen.com/english/advisories/2008/1537/references · Note
• http://securityfocus.com/bid/29215 · Note