PT-2010-3646 · Wolfram Research · Mathematica

Paul Szabo · Published 2010-05-24 · Updated 2018-10-10 · CVE-2010-2027

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mathematica version 7

Description The issue allows local users to overwrite arbitrary files via a symlink attack on files within /tmp/MathLink/ or /tmp/fonts$$.conf when running on Linux.

Recommendations For Mathematica version 7, consider restricting access to the /tmp/MathLink/ directory and the /tmp/fonts$$.conf file to prevent a symlink attack until a patch is available.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2010-2027

Affected Products

Mathematica

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2010-2027 · Security Note
• http://secunia.com/advisories/39805 · Vendor Advisory
• http://marc.info/?l=full-disclosure&m=127380255201760&w=2 · Note
• http://securityfocus.com/archive/1/511298/100/0/threaded · Note