PT-2010-4426 · Slim · Slim

Niels Heinen · Published 2010-08-30 · Updated 2010-08-31 · CVE-2010-2945

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SLiM versions prior to 1.3.2

Description The issue is related to the default configuration of SLiM, where the default path option in slim.conf starts with ./ (dot slash), potentially allowing local users to gain privileges via a Trojan horse program in the current working directory. This is related to the cfg.cpp file.

Recommendations For versions prior to 1.3.2, update to version 1.3.2 or later to resolve the issue. As a temporary workaround, consider modifying the default path option in slim.conf to remove the ./ (dot slash) at the beginning, or restrict access to the slim.conf file to prevent modifications.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2010-2945

Affected Products

Slim

References · 8

• https://osv.dev/vulnerability/DEBIAN-CVE-2010-2945 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-2945 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-2945 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2945 · Security Note
• http://secunia.com/advisories/41005 · Vendor Advisory
• http://openwall.com/lists/oss-security/2010/08/19/8 · Note
• http://svn.berlios.de/viewvc/slim?view=revision&revision=171 · Note
• http://openwall.com/lists/oss-security/2010/08/20/10 · Note