PT-2012-2925 · Paste+2 · Paste Script+2

Jan Lieskovsky · Published 2012-05-01 · Updated 2022-05-17 · CVE-2012-0878

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Paste Script versions 1.7.5 and earlier

Description The issue arises from improper handling of group memberships during execution with root privileges. This could allow remote attackers to bypass intended file-access restrictions by exploiting a web application that utilizes the local filesystem.

Recommendations For Paste Script versions 1.7.5 and earlier, update to a version that properly sets group memberships during execution with root privileges to prevent attackers from bypassing file-access restrictions.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CESA-2012_1206

CVE-2012-0878

GHSA-27PX-QPMJ-QG38

PYSEC-2012-15

RHSA-2012:1206

RHSA-2012_1206

Affected Products

Centos

Paste Script

Red Hat

References · 29

• https://bitbucket.org/ianb/pastescript/pull-request/3/fix-group-permissions-for-pastescriptserve · Patch
• http://rhn.redhat.com/errata/RHSA-2012-1206.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0878 · Security Note
• https://bitbucket.org/ianb/pastescript/changeset/a19e462769b4 · Patch
• https://osv.dev/vulnerability/GHSA-27px-qpmj-qg38 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-0878 · Security Note
• http://openwall.com/lists/oss-security/2012/02/23/1 · Patch
• https://osv.dev/vulnerability/PYSEC-2012-15 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-0878 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2012-1206.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-0878 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-0878 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/paste/PYSEC-2012-15.yaml · Note
• https://github.com/cdent/pastescript/commit/b5f36f2995e1ae117cc53d2bd458d7fb33e4cabe · Note
• https://github.com/pasteorg/pastescript · Note