PT-2011-1159 · None+1 · Conky+1

Segooon + 1 · Published 2011-10-13 · Updated 2024-06-15 · CVE-2011-3616

Positive Technologies (AI Summary)

CVSS v2.0

6.3

Medium

Base vector

AV:L/AC:M/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Conky versions prior to 1.8.1

Description The issue concerns a potential security risk in the Conky package, which could lead to the compromise of data integrity and availability. This can be exploited locally. Specifically, the getSkillname function in the eve module of Conky allows local users to overwrite arbitrary files via a symlink attack on /tmp/.cesf.

Recommendations For Conky versions prior to 1.8.1, update to version 1.8.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /tmp/.cesf file to minimize the risk of exploitation.

Exploit

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

ALT-PU-2013-1044

BDU:2015-09424

CVE-2011-3616

OPENSUSE-SU-2024:10093-1

Affected Products

Alt Linux

Conky

References · 18

• 🔥 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=612033 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3616 · Security Note
• http://secunia.com/advisories/46353 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-3616 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2011-3616 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-3616 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09424 · Security Note
• http://secunia.com/advisories/43225 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-3616 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10093-1 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2013-1044 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-201110-09.xml · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201110-09.xml · Note
• https://packages.altlinux.org/ru/vuln/CVE-2011-3616 · Note
• http://openwall.com/lists/oss-security/2011/10/09/4 · Note