PT-2011-3671 · Fabric · Fabric

Jan Lieskovsky · Published 2011-07-27 · Updated 2022-05-17 · CVE-2011-2185

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Fabric versions prior to 1.1.0

Description The issue allows local users to overwrite arbitrary files via a symlink attack on certain files, including /tmp/fab.*.tar files or other files in the top level of /tmp/.

Recommendations For versions prior to 1.1.0, update to version 1.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the /tmp/ directory to minimize the risk of exploitation. Avoid using symlinks in the affected directory until the issue is resolved.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2011-2185

GHSA-XWG2-QC6C-7C3Q

Affected Products

Fabric

References · 17

• https://cve.org/CVERecord?id=CVE-2011-2185 · Security Note
• https://osv.dev/vulnerability/CVE-2011-2185 · Vendor Advisory
• http://code.fabfile.org/projects/fabric/files/Fabric-1.1.0.tar.gz · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2011-2185 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2185 · Security Note
• https://osv.dev/vulnerability/GHSA-xwg2-qc6c-7c3q · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062534.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2011-2185 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-2185 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-2185 · Vendor Advisory
• https://github.com/fabric/fabric · Note
• https://github.com/fabric/fabric/commit/d7470d2db919ffcee80c245cf87e6d8d4ba6909c · Note
• https://github.com/fabric/fabric/commit/3445b5653cd297039443110548fb3cab2e8e25af · Note
• http://openwall.com/lists/oss-security/2011/06/06/12 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629003 · Note