Lucene search

[email protected]CVE-2008-4946

HistoryOct 03, 2022 - 4:13 p.m.

CVE-2008-4946

2022-10-0316:13:58

CWE-59

[email protected]

web.nvd.nist.gov

convirt

0.8.2

local users

symlink attack

file overwrite

6.9 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

6.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

convirt 0.8.2 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/set_output temporary file, related to the (1) template/provision.sh, (2) Linux_CD_Install/provision.sh, (3) Fedora_PV_Install/provision.sh, (4) CentOS_PV_Install/provision.sh, (5) common/provision.sh, (6) example/provision.sh, and (7) Windows_CD_Install/provision.sh scripts in image_store/.

Affected configurations

NVD

Node

convirtureconvirtMatch0.8.2

CPENameOperatorVersion
convirture:convirtconvirture convirteq0.8.2

CPE	Name	Operator	Version
convirture:convirt	convirture convirt	eq	0.8.2

References

bugs.debian.org/496419

dev.gentoo.org/~rbu/security/debiantemp/convirt

www.openwall.com/lists/oss-security/2008/10/30/2

bugs.gentoo.org/show_bug.cgi?id=235770

6.9 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

6.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2008-4946

ubuntucve1 nvd1 prion1 cvelist1