PT-2009-3046 · Enomaly · Enomaly Elastic Computing Platform

Published 2009-02-02 · Updated 2018-10-11 · CVE-2009-0390

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Enomaly Elastic Computing Platform (ECP) versions prior to 2.1.1

Description The issue allows local users to send signals to arbitrary processes by populating the /tmp/enomalism2.pid file with command-line arguments for the kill program. This is due to an argument injection vulnerability.

Recommendations For versions prior to 2.1.1, update to version 2.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /tmp/enomalism2.pid file to prevent malicious population of command-line arguments.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-0390

Affected Products

Enomaly Elastic Computing Platform

References · 3

• 🔥 https://exploit-db.com/exploits/8067 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0390 · Security Note
• http://securityfocus.com/archive/1/500573/100/0/threaded · Note