Vulnerability CVE-2011-4114
Published: 2012-01-13   Modified: 2012-02-13

Description:
The par_mktmpdir function in the PAR::Packer module before 1.012 for Perl creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory, which allows local users to overwrite files when another user extracts a PAR packed program. NOTE: a similar vulnerability was reported for PAR, but this has been assigned a different CVE identifier.

Type:

CWE-264

 (Permissions, Privileges, and Access Controls)

CVSS2 => (AV:L/AC:M/Au:N/C:N/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.3/10
4.9/10
3.4/10
Exploit range
Attack complexity
Authentication
Local
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
Partial
Affected software
Roderich schupp -> Par-packer module 

 References:
https://bugzilla.redhat.com/show_bug.cgi?id=753955
http://lists.fedoraproject.org/pipermail/package-announce/2011-December/071099.html
https://rt.cpan.org/Public/Bug/Display.html?id=69560
http://www.openwall.com/lists/oss-security/2011/11/04/4
http://www.openwall.com/lists/oss-security/2011/11/04/2
http://lists.fedoraproject.org/pipermail/package-announce/2011-December/071091.html
Copyright 2024, cxsecurity.com

 

Back to Top