Lucene search
HistoryJan 28, 2014 - 12:55 a.m.
CVE-2014-1640
security
vulnerability
cve-2014-1640
symlink attack
local users
axiom
tempfile
nvd
6.5 Medium
AI Score
Confidence
Low
3.3 Low
CVSS2
Access Vector
Access Complexity
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:N/I:P/A:P
0.0004 Low
EPSS
Percentile
5.2%
axiom-test.sh in axiom 20100701-1.1 uses tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
Affected configurations
Node
debianaxiomMatch20100701-1.1
| CPE | Name | Operator | Version |
|---|---|---|---|
| debian:axiom | debian axiom | eq | 20100701-1.1 |
Related
nvd
nvd
CVE-2014-1640
2014-01-28 00:55:04
cvelist
cvelist
CVE-2014-1640
2014-01-28 00:00:00
ubuntucve
ubuntucve
CVE-2014-1640
2014-01-28 00:00:00
prion
prion
Code injection
2014-01-28 00:55:00
debiancve
debiancve
CVE-2014-1640
2014-01-28 00:55:04
6.5 Medium
AI Score
Confidence
Low
3.3 Low
CVSS2
Access Vector
Access Complexity
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:N/I:P/A:P
0.0004 Low
EPSS
Percentile
5.2%
Related for CVE-2014-1640