PT-2012-6307 · Golismero · Golismero

Published 2012-03-19 · Updated 2012-03-19

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions GoLismero versions prior to Git revision 2b3bb43d6867

Description The issue allows local users to overwrite arbitrary files via a symlink attack on GoLismero-controlled files. This can be demonstrated using the Admin/changes.dat file.

Recommendations For GoLismero versions prior to Git revision 2b3bb43d6867, consider updating to a version that includes the fix for this issue, specifically Git revision 2b3bb43d6867 or later. As a temporary workaround, restrict access to the libs/updater.py file to minimize the risk of exploitation. Avoid using the Admin/changes.dat file in a way that could be exploited by the vulnerability until the issue is resolved.

Related Identifiers

PYSEC-2012-31

Affected Products

Golismero

References · 5

• https://osv.dev/vulnerability/PYSEC-2012-31 · Vendor Advisory
• http://openwall.com/lists/oss-security/2012/01/17/7 · Note
• http://osvdb.org/78472 · Note
• http://openwall.com/lists/oss-security/2012/01/17/10 · Note
• http://code.google.com/p/golismero/source/detail?r=2b3bb43d68676efd687361f7de29380189031ab8 · Note