PT-2013-1132 · Fusionforge · Fusionforge

Helmut Grohne · Published 2013-03-12 · Updated 2013-03-19 · CVE-2013-1423

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FusionForge versions 5.0 through 5.2

Description The issue allows local users to change arbitrary file permissions, obtain sensitive information, and have other unspecified impacts via a symlink or hard link attack on certain files. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of these vulnerabilities can be carried out by a local attacker.

Recommendations For FusionForge versions 5.0 through 5.2, consider restricting access to the affected files, such as contrib/gforge-3.0-cronjobs.patch, cronjobs/homedirs.php, and others, to minimize the risk of exploitation. As a temporary workaround, avoid using the vulnerable files until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

BDU:2015-03580

CVE-2013-1423

DSA-2633-1

Affected Products

Fusionforge

References · 13

• https://bdu.fstec.ru/vul/2015-03580 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1423 · Security Note
• http://debian.org/security/2013/dsa-2633 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1423 · Security Note
• http://osvdb.org/90605 · Note
• https://fusionforge.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=fusionforge/fusionforge.git%3Ba=commitdiff%3Bh=1fc730b97c797e03b89cd37823ab345d35286cf4 · Note
• https://fusionforge.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=fusionforge/fusionforge.git%3Ba=commitdiff%3Bh=0cc51b3aca51fa915a35195fdf729bcdb903f2af · Note
• http://openwall.com/lists/oss-security/2013/02/25/5 · Note
• http://secunia.com/advisories/52318 · Note
• http://secunia.com/advisories/52371 · Note
• http://debian.org/security/dsa-2633 · Note
• https://fusionforge.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=fusionforge/fusionforge.git%3Ba=commitdiff%3Bh=9937b9d94ab60ff67fe249c1b9a6c8e3fc1778ba · Note
• http://securityfocus.com/bid/58143 · Note