Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ ΡΠ΄Π°Π»Π΅Π½ΠΈΡ ΡΠ°ΠΉΠ»ΠΎΠ² ΠΏΡΠΈ ΠΎΠ±Π½ΠΎΠ²Π»Π΅Π½ΠΈΠΈ Windows Ρ ΠΈΡΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°Π½ΠΈΠ΅ΠΌ Π½Π΅Π²Π΅ΡΠ½ΠΎΠ³ΠΎ ΠΏΡΡΠΈ ΠΊ ΡΠ°ΠΉΠ»Ρ "update.log"
ΠΠΏΠΈΡΠ°Π½ΠΈΠ΅
ΠΠ° ΡΠΈΡΡΠ΅ΠΌΠ°Ρ Windows ΠΆΡΡΠ½Π°Π» ΠΎΠ±Π½ΠΎΠ²Π»Π΅Π½ΠΈΠΉ ΡΠ΄Π°Π»ΡΠ΅Ρ ΡΠ°ΠΉΠ» "update.log" ΠΏΠ΅ΡΠ΅Π΄ ΡΠ΅ΠΌ, ΠΊΠ°ΠΊ Π·Π°ΠΏΠΈΡΠ°ΡΡ Π½ΠΎΠ²ΡΠΉ ΠΆΡΡΠ½Π°Π» Ρ ΡΠ΅ΠΌ ΠΆΠ΅ ΠΈΠΌΠ΅Π½Π΅ΠΌ. ΠΡΡΡ ΠΊ ΡΡΠΎΠΌΡ ΡΠ°ΠΉΠ»Ρ ΠΏΠ΅ΡΠ΅Π΄Π°Π΅ΡΡΡ Π² ΠΊΠΎΠΌΠ°Π½Π΄Π½ΠΎΠΉ ΡΡΡΠΎΠΊΠ΅, ΡΡΠΎ ΠΌΠΎΠΆΠ΅Ρ ΠΏΠΎΠ·Π²ΠΎΠ»ΠΈΡΡ Π·Π»ΠΎΡΠΌΡΡΠ»Π΅Π½Π½ΠΈΠΊΠ°ΠΌ Π² ΡΠΎΡΠ΅ΡΠ°Π½ΠΈΠΈ Ρ Π΄ΡΡΠ³ΠΈΠΌ Π»ΠΎΠΊΠ°Π»ΡΠ½ΠΎΠΉ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΡΡ ΡΠ΄Π°Π»ΠΈΡΡ Π΄ΡΡΠ³ΠΎΠΉ ΡΠ°ΠΉΠ» Ρ ΠΈΠΌΠ΅Π½Π΅ΠΌ "update.log", Π° Π½Π΅ ΡΠΎΡ, ΠΊΠΎΡΠΎΡΡΠΉ ΠΏΡΠ΅Π΄ΠΏΠΎΠ»Π°Π³Π°Π΅ΡΡΡ.
ΠΠ°ΡΡΠΎΠ½ΡΡΡΠ΅ Π²Π΅ΡΡΠΈΠΈ ΠΠ
- Firefox Π½Π° Windows Π²Π΅ΡΡΠΈΠΉ Π½ΠΈΠΆΠ΅ 55
Π’ΠΈΠΏ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠΈ
Π£Π΄Π°Π»Π΅Π½ΠΈΠ΅ ΡΠ°ΠΉΠ»ΠΎΠ²
Π‘ΡΡΠ»ΠΊΠΈ
- Third Party AdvisoryVDB Entry
- Issue TrackingPatchVendor Advisory
- Vendor Advisory
- Third Party AdvisoryVDB Entry
- Issue TrackingPatchVendor Advisory
- Vendor Advisory
Π£ΡΠ·Π²ΠΈΠΌΡΠ΅ ΠΊΠΎΠ½ΡΠΈΠ³ΡΡΠ°ΡΠΈΠΈ
ΠΠ΄Π½ΠΎΠ²ΡΠ΅ΠΌΠ΅Π½Π½ΠΎ
EPSS
4.7 Medium
CVSS3
3.3 Low
CVSS2
ΠΠ΅ΡΠ΅ΠΊΡΡ
Π‘Π²ΡΠ·Π°Π½Π½ΡΠ΅ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠΈ
On Windows systems, the logger run by the Windows updater deletes the file "update.log" before it runs in order to write a new log of that name. The path to this file is supplied at the command line to the updater and could be used in concert with another local exploit to delete a different file named "update.log" instead of the one intended. Note: This attack only affects Windows operating systems. Other operating systems are not affected. This vulnerability affects Firefox < 55.
On Windows systems, the logger run by the Windows updater deletes the ...
On Windows systems, the logger run by the Windows updater deletes the file "update.log" before it runs in order to write a new log of that name. The path to this file is supplied at the command line to the updater and could be used in concert with another local exploit to delete a different file named "update.log" instead of the one intended. Note: This attack only affects Windows operating systems. Other operating systems are not affected. This vulnerability affects Firefox < 55.
EPSS
4.7 Medium
CVSS3
3.3 Low
CVSS2