漏洞信息详情
Net-Acct符号链接漏洞
- CNNVD编号:CNNVD-200409-016
- 危害等级: 低危
- CVE编号: CVE-2004-0851
- 漏洞类型: 访问验证错误
- 发布时间: 2004-09-08
- 威胁类型: 本地
- 更新时间: 2005-10-20
- 厂 商: ulrich_callmeier
- 漏洞来源: Discovery of this ...
漏洞简介
Net-Acct 0.71之前的版本的(1) write_list和(2) dump_curr_list函数存在漏洞。本地用户借助暂时文件的符号链接攻击覆盖任意文件。
漏洞公告
Debian Linux has released an advisory (DSA 559-1) along with fixes dealing with this issue. Please see the referenced advisory for more information. The vendor has released a patch to address this issue: Ulrich Callmeier Net-Acct 0.6
- Net-Acct net-acct-notempfiles.patch http://exorsus.net/projects/net-acct/net-acct-notempfiles.patch
- Net-Acct net-acct-notempfiles.patch http://exorsus.net/projects/net-acct/net-acct-notempfiles.patch
- Debian net-acct_0.71-5woody1_alpha.debDebian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/n/net-acct/net-acct_0.71- 5woody1_alpha.deb
- Debian net-acct_0.71-5woody1_arm.debDebian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/n/net-acct/net-acct_0.71- 5woody1_arm.deb
- Debian net-acct_0.71-5woody1_hppa.debDebian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/n/net-acct/net-acct_0.71- 5woody1_hppa.deb
- Debian net-acct_0.71-5woody1_i386.debDebian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/n/net-acct/net-acct_0.71- 5woody1_i386.deb
- Debian net-acct_0.71-5woody1_ia64.debDebian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/n/net-acct/net-acct_0.71- 5woody1_ia64.deb
- Debian net-acct_0.71-5woody1_m68k.debDebian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/n/net-acct/net-acct_0.71- 5woody1_m68k.deb
- Debian net-acct_0.71-5woody1_mips.debDebian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/n/net-acct/net-acct_0.71- 5woody1_mips.deb
- Debian net-acct_0.71-5woody1_mipsel.debDebian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/n/net-acct/net-acct_0.71- 5woody1_mipsel.deb
- Debian net-acct_0.71-5woody1_powerpc.debDebian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/n/net-acct/net-acct_0.71- 5woody1_powerpc.deb
- Debian net-acct_0.71-5woody1_s390.debDebian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/n/net-acct/net-acct_0.71- 5woody1_s390.deb
- Debian net-acct_0.71-5woody1_sparc.debDebian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/n/net-acct/net-acct_0.71- 5woody1_sparc.deb
- Net-Acct net-acct-notempfiles.patch http://exorsus.net/projects/net-acct/net-acct-notempfiles.patch
参考网址
来源: XF 名称: net-acct-tmp-symlink(17283) 链接:http://xforce.iss.net/xforce/xfdb/17283 来源: BID 名称: 11125 链接:http://www.securityfocus.com/bid/11125 来源: DEBIAN 名称: DSA-559 链接:http://www.debian.org/security/2004/dsa-559 来源: SECUNIA 名称: 12476 链接:http://secunia.com/advisories/12476 来源: BUGTRAQ 名称: 20040908 Insecure Temporary File Creation Vulnerability in Net-Acct 链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109466910232385&w=2 来源: exorsus.net 链接:http://exorsus.net/projects/net-acct/net-acct-notempfiles.patch
受影响实体
- Ulrich_callmeier Net-Acct:0.6
- Ulrich_callmeier Net-Acct:0.7
- Ulrich_callmeier Net-Acct:0.71
补丁
暂无
评论