PT-2009-1031 · Debian+1 · Debian+1

James Stone · Published 2009-04-09 · Updated 2009-04-16 · CVE-2009-1253

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Tunapie version 2.1 Tunapie (affected versions not specified) in Debian GNU/Linux

Description The issue allows local users to overwrite arbitrary files via a symlink attack on an unspecified temporary file. Additionally, there are multiple vulnerabilities in the Tunapie package of the Debian GNU/Linux operating system that can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information.

Recommendations For Tunapie version 2.1, consider restricting access to temporary files to prevent symlink attacks until a patch is available. For Tunapie in Debian GNU/Linux, restrict remote access to the Tunapie package to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

BDU:2015-03455

CVE-2009-1253

DSA-1764-1

Affected Products

Debian

Tunapie

References · 12

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1253 · Security Note
• http://debian.org/security/2009/dsa-1764 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1253 · Security Note
• https://bdu.fstec.ru/vul/2015-03455 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1254 · Security Note
• http://vupen.com/english/advisories/2009/0972 · Note
• http://securityfocus.com/bid/34417 · Note
• http://debian.org/security/dsa-1764 · Note
• http://osvdb.org/53426 · Note
• https://launchpad.net/bugs/cve/2009-1253 · Note
• https://launchpad.net/bugs/314591 · Note
• http://secunia.com/advisories/34643 · Note