PT-2010-5291 · Unknown · Monkeysphere

Published 2010-10-27 · Updated 2011-01-04 · CVE-2010-4096

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Monkeysphere versions 0.31 through 0.32

Description The issue allows local users to execute arbitrary code via unknown manipulations related to the "monkeysphere-authentication keys-for-user" command, specifically affecting the share/ma/keys for user component.

Recommendations For Monkeysphere versions 0.31 and 0.32, consider restricting access to the monkeysphere-authentication keys-for-user command until a patch is available. As a temporary workaround, avoid using the share/ma/keys for user component in sensitive operations to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2010-4096

Affected Products

Monkeysphere

References · 7

• https://security-tracker.debian.org/tracker/CVE-2010-4096 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-4096 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-4096 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-4096 · Vendor Advisory
• https://lists.riseup.net/www/arc/monkeysphere/2010-10/msg00066.html · Note
• http://web.monkeysphere.info/news/CVE-2010-4096 · Note
• http://secunia.com/advisories/42067 · Note