PT-2010-1147 · Gnustep · Gnustep-Base

Dan Rosenberg + 1 · Published 2010-05-12 · Updated 2014-01-20 · CVE-2010-1457

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions gnustep-base versions prior to 1.20.1

Description The issue concerns multiple vulnerabilities in the gnustep-base package that can lead to breaches in confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited locally. Specifically, a flaw in Tools/gdomap.c in gdomap in GNUstep Base before version 1.20.0 allows local users to read arbitrary files via certain options, which prints file contents in an error message.

Recommendations For versions prior to 1.20.1, update to version 1.20.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the gdomap tool until a patch is available.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2015-09691

CVE-2010-1457

Affected Products

Gnustep-Base

References · 17

• 🔥 http://securityfocus.com/bid/40005 · Exploit
• 🔥 https://bugs.launchpad.net/ubuntu/+source/gnustep-base/+bug/573108 · Exploit
• 🔥 https://exploit-db.com/exploits/33963 · Exploit
• https://cve.org/CVERecord?id=CVE-2010-1457 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2010-1457 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09691 · Security Note
• https://osv.dev/vulnerability/CVE-2010-1457 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2010-1457 · Vendor Advisory
• http://secunia.com/advisories/39746 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-1457 · Vendor Advisory
• https://ubuntu.com/security/CVE-2010-1457 · Vendor Advisory
• http://ftpmain.gnustep.org/pub/gnustep/core/gnustep-base-1.20.0.tar.gz · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2010-1457 · Security Note
• http://openwall.com/lists/oss-security/2010/05/07/6 · Note
• http://thread.gmane.org/gmane.comp.lib.gnustep.bugs/12336 · Note