Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2013-4419

Опубликовано: 05 нояб. 2013
Источник: nvd
CVSS2: 6.8
EPSS Низкий

Описание

The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:libguestfs:libguestfs:*:*:*:*:*:*:*:*
Версия от 1.20.0 (включая) до 1.20.12 (включая)
cpe:2.3:a:libguestfs:libguestfs:*:*:*:*:*:*:*:*
Версия от 1.22.0 (включая) до 1.22.7 (включая)
Конфигурация 2

Одно из

cpe:2.3:a:suse:suse_linux_enterprise_software_development_kit:11.0:sp3:*:*:*:*:*:*
cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:sp3:*:*:*:*:*:*

EPSS

Процентиль: 25%
0.00083
Низкий

6.8 Medium

CVSS2

Дефекты

CWE-264

Связанные уязвимости

ubuntu
почти 12 лет назад

The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.

redhat
почти 12 лет назад

The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.

debian
почти 12 лет назад

The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when ...

github
больше 3 лет назад

The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.

oracle-oval
больше 11 лет назад

ELSA-2013-1536: libguestfs security, bug fix, and enhancement update (MODERATE)

EPSS

Процентиль: 25%
0.00083
Низкий

6.8 Medium

CVSS2

Дефекты

CWE-264