Информационная безопасность
[RU] switch to English


Многочисленные уязвимости безопасности в Augeas
Опубликовано:29 января 2014 г.
Источник:
SecurityVulns ID:13538
Тип:локальная
Уровень опасности:
5/10
Описание:Проблема символьных линков, слабые разрешения.
Затронутые продукты:AUGEAS : Augeas 1.1
CVE:CVE-2013-6412 (The transform_save function in transform.c in Augeas 1.0.0 through 1.1.0 does not properly calculate the permission values when the umask contains a "7," which causes world-writable permissions to be used for new files and allows local users to modify the files via unspecified vectors.)
 CVE-2012-0787 (The clone_file function in transfer.c in Augeas before 1.0.0, when copy_if_rename_fails is set and EXDEV or EBUSY is returned by the rename function, allows local users to overwrite arbitrary files and obtain sensitive information via a bind mount on the (1) .augsave or (2) destination file when using the backup save option, or (3) .augnew file when using the newfile save option.)
 CVE-2012-0786 (The transform_save function in transform_save in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on a .augnew file.)
Оригинальный текстdocumentMANDRIVA, [ MDVSA-2014:022 ] augeas (29.01.2014)

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород