PT-2010-4416 · Oracle · Hsolink

Published 2010-08-02 · Updated 2017-08-17 · CVE-2010-2929

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions hsolink version 1.0.118

Description The issue allows local users to gain privileges via a modified PATH environment variable. This is exploited during the execution of certain programs, including route, mv, and cp.

Recommendations For hsolink version 1.0.118, consider restricting the modification of the PATH environment variable to prevent privilege escalation. As a temporary workaround, restrict access to the route, mv, and cp programs until a patch is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-2929

Affected Products

Hsolink

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2010-2929 · Security Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=590670 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/60877 · Note
• http://ftp.de.debian.org/debian/pool/main/h/hsolink/hsolink_1.0.118.orig.tar.gz · Note
• http://osvdb.org/66837 · Note