PT-2012-2038 · Par · Par

Published 2012-01-13 · Updated 2017-08-29 · CVE-2011-5060

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:L/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions PAR module versions prior to 1.003

Description The issue concerns the par mktmpdir function in the PAR module, which creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory. This allows local users to overwrite files when another user extracts a PAR packed program.

Recommendations For PAR module versions prior to 1.003, update to version 1.003 or later to resolve the issue. As a temporary workaround, consider restricting access to the temporary directory used by the par mktmpdir function to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2011-5060

Affected Products

Par

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2011-5060 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2011-5060 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-5060 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-5060 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=753955 · Patch
• http://cpansearch.perl.org/src/RSCHUPP/PAR-1.003/ChangeLog · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72435 · Note
• https://rt.cpan.org/Public/Bug/Display.html?id=69560 · Note