PT-2008-6165 · Bk2Site · Bk2Site

Robert Buchholz · Published 2008-11-07 · Updated 2017-08-08 · CVE-2008-4995

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions bk2site version 1.1.9

Description The issue allows local users to overwrite arbitrary files via a symlink attack on the /tmp/redirect.log temporary file in the redirect.pl script. This is limited to debug mode, which is disabled by default.

Recommendations For bk2site version 1.1.9, consider disabling debug mode to prevent exploitation of this issue. As a temporary workaround, restrict access to the redirect.pl script and the /tmp/redirect.log file to minimize the risk of arbitrary file overwrites.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2008-4995

Affected Products

Bk2Site

References · 6

• 🔥 http://dev.gentoo.org/~rbu/security/debiantemp/bk2site · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4995 · Security Note
• http://openwall.com/lists/oss-security/2008/10/30/2 · Note
• http://bugs.debian.org/496430 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46543 · Note
• https://bugs.gentoo.org/show_bug.cgi?id=235770 · Note