PT-2008-4729 · Red Hat · Cygwin

Derek Callaway · Published 2008-07-28 · Updated 2018-10-11 · CVE-2008-3323

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cygwin setup.exe version prior to 2.573.2.3

Description The issue is related to the improper verification of package authenticity, allowing remote Cygwin mirror servers or man-in-the-middle attackers to execute arbitrary code via a package list containing the MD5 checksum of a Trojan horse package.

Recommendations For Cygwin setup.exe version prior to 2.573.2.3, update to version 2.573.2.3 or later to resolve the issue. As a temporary workaround, consider verifying the authenticity of packages manually until a patch is applied. Restrict access to untrusted Cygwin mirror servers to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-3323

Affected Products

Cygwin

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2008-3323 · Security Note
• http://cygwin.com/ml/cygwin-announce/2008-08/msg00001.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44047 · Note
• http://securityfocus.com/archive/1/494756/100/0/threaded · Note
• http://securityreason.com/securityalert/4051 · Note
• http://secunia.com/advisories/31271 · Note
• http://security-objectives.com/advisories/SECOBJADV-2008-02.txt · Note
• http://securityfocus.com/bid/30375 · Note
• http://vupen.com/english/advisories/2008/2321 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=449929 · Note