PT-2011-1506 · Gnu · Gnash

Jakub Wilk · Published 2011-01-14 · Updated 2012-06-19 · CVE-2010-4337

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:L/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions gnash version 0.8.8

Description The issue allows local users to overwrite arbitrary files via a symlink attack on temporary files created by the configure script. Specifically, the attack targets the /tmp/gnash-configure-errors.$$, /tmp/gnash-configure-warnings.$$, or /tmp/gnash-configure-recommended.$$ files.

Recommendations For gnash version 0.8.8, consider restricting access to the configure script to prevent unauthorized modifications, and avoid using the script in environments where local users could exploit this issue. As a temporary workaround, consider monitoring and restricting access to the mentioned temporary files until a patch is available.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2010-4337

DSA-2435-1

Affected Products

Gnash

References · 10

• https://osv.dev/vulnerability/UBUNTU-CVE-2010-4337 · Vendor Advisory
• http://secunia.com/advisories/42416 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-4337 · Security Note
• http://debian.org/security/2012/dsa-2435 · Vendor Advisory
• https://ubuntu.com/security/CVE-2010-4337 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2010-4337 · Security Note
• http://secunia.com/advisories/48466 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=605419 · Note
• http://osvdb.org/69533 · Note
• http://securityfocus.com/bid/45102 · Note