Vulnerability CVE-2008-3699


Published: 2008-08-14   Modified: 2012-02-12

Description:
The MagnatuneBrowser::listDownloadComplete function in magnatunebrowser/magnatunebrowser.cpp in Amarok before 1.4.10 allows local users to overwrite arbitrary files via a symlink attack on the album_info.xml temporary file.

Type:

CWE-59

(Improper Link Resolution Before File Access ('Link Following'))

Vendor: Amarok
Product: Amarok 
Version: 1.4.9.1;

CVSS2 => (AV:L/AC:M/Au:N/C:N/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.3/10
4.9/10
3.4/10
Exploit range
Attack complexity
Authentication
Local
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
Partial

 References:
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00097.html
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00057.html
http://xforce.iss.net/xforce/xfdb/44399
http://www.vupen.com/english/advisories/2008/2338
http://www.ubuntu.com/usn/usn-657-1
http://www.securityfocus.com/bid/30662
http://www.mandriva.com/security/advisories?name=MDVSA-2008:172
http://websvn.kde.org/?view=rev&revision=846626
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.455790
http://security.gentoo.org/glsa/glsa-200809-08.xml
http://secunia.com/advisories/32357
http://secunia.com/advisories/31839
http://secunia.com/advisories/31663
http://secunia.com/advisories/31418
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494765
http://amarok.kde.org/en/releases/1/4/10

Related CVE
CVE-2009-0135
Multiple integer overflows in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to execute arbitrary code via an Audible Audio (.aa) file with a large (1) nlen or (2) vlen Tag ...
CVE-2009-0136
Multiple array index errors in the Audible::Tag::readTag function in metadata/audible/audibletag.cpp in Amarok 1.4.10 through 2.0.1 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via an Audible Audio...
CVE-2006-6979
The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters.
CVE-2005-2029
amaroK Web Frontend 1.3 stores the globals.inc file under the web root without a .php extension and insufficient access control, which allows remote attackers to obtain the database username and password via a direct request to the file.

Copyright 2019, cxsecurity.com

 

Back to Top