PT-2010-4610 · Yokka+4 · Yokka Noeditor+7

Makoto Shiotsuki · Published 2010-10-25 · Updated 2010-10-27 · CVE-2010-3165

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Yokka NoEditor versions 1.33.1.1 and earlier OuiEditor versions 1.6.1.1 and earlier UnEditor versions 1.10.1.2 and earlier DeuxEditor versions 1.7.1.2 and earlier SQLEditorXP versions 3.14.1.2 and earlier SQLEditorTE versions 1.9.1.3 and earlier SQLEditor8 versions 3.8.1.2 and earlier SQLEditorClassic versions 1.8.1.3 and earlier

Description The issue allows local users to gain privileges via a Trojan horse executable file in the current working directory due to an untrusted search path vulnerability.

Recommendations Yokka NoEditor versions 1.33.1.1 and earlier: Update to a version later than 1.33.1.1 to resolve the issue. OuiEditor versions 1.6.1.1 and earlier: Update to a version later than 1.6.1.1 to resolve the issue. UnEditor versions 1.10.1.2 and earlier: Update to a version later than 1.10.1.2 to resolve the issue. DeuxEditor versions 1.7.1.2 and earlier: Update to a version later than 1.7.1.2 to resolve the issue. SQLEditorXP versions 3.14.1.2 and earlier: Update to a version later than 3.14.1.2 to resolve the issue. SQLEditorTE versions 1.9.1.3 and earlier: Update to a version later than 1.9.1.3 to resolve the issue. SQLEditor8 versions 3.8.1.2 and earlier: Update to a version later than 3.8.1.2 to resolve the issue. SQLEditorClassic versions 1.8.1.3 and earlier: Update to a version later than 1.8.1.3 to resolve the issue.

Fix

Related Identifiers

CVE-2010-3165

Affected Products

Deuxeditor

Ouieditor

Sqleditor8

Sqleditorclassic

Sqleditorte

Sqleditorxp

Ueditor

Yokka Noeditor

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2010-3165 · Security Note
• http://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-000049.html · Note
• http://jvn.jp/en/jp/JVN07497935/index.html · Note