PT-2014-4270 · Axiom · Axiom

Published 2014-01-28 · Updated 2017-08-29 · CVE-2014-1640

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:L/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions axiom version 20100701-1.1

Description The issue allows local users to overwrite arbitrary files via a symlink attack. This is due to the axiom-test.sh script in axiom using tempfile to create a temporary file, but then appending a suffix to the original filename and writing to this new filename.

Recommendations For axiom version 20100701-1.1, consider modifying the axiom-test.sh script to properly handle temporary file creation and avoid appending suffixes to original filenames, thereby preventing symlink attacks. As a temporary workaround, consider restricting access to the axiom-test.sh script until a proper fix is implemented.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2014-1640

Affected Products

Axiom

References · 9

• https://osv.dev/vulnerability/DEBIAN-CVE-2014-1640 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-1640 · Security Note
• https://osv.dev/vulnerability/CVE-2014-1640 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-1640 · Vendor Advisory
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736358 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90663 · Note
• http://osvdb.org/102383 · Note
• http://openwall.com/lists/oss-security/2014/01/22/3 · Note
• http://openwall.com/lists/oss-security/2014/01/22/4 · Note