CVE-2005-1918
2.06%V4
2006-02-21
19h00 +00:00
19h00 +00:00
Notifikasi untuk CVE tertentu
Tetap terinformasi tentang perubahan untuk CVE tertentu.
Deskripsi CVE
The original patch for a GNU tar directory traversal vulnerability (CVE-2002-0399) in Red Hat Enterprise Linux 3 and 2.1 uses an "incorrect optimization" that allows user-assisted attackers to overwrite arbitrary files via a crafted tar file, probably involving "/../" sequences with a leading "/".
Informasi CVE
Kelemahan Terkait
| Nama Kelemahan | Sumber | |
|---|---|---|
| Improper Limitation of a Pathname to a Restricted Directory The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Metrik
| Metrik | Skor | Tingkat keparahan | CVSS Vektor | Sumber |
|---|---|---|---|---|
| V2 | 2.6 | AV:N/AC:H/Au:N/C:N/I:P/A:N | nvd@nist.gov |
EPSS
EPSS adalah model penilaian yang memprediksi kemungkinan suatu kerentanan dieksploitasi.
Skor EPSS
Model EPSS menghasilkan skor probabilitas antara 0 dan 1 (0 hingga 100%). Semakin tinggi skor, semakin besar probabilitas bahwa suatu kerentanan akan dieksploitasi.
Persentil EPSS
Persentil digunakan untuk meranking CVE berdasarkan skor EPSS mereka. Misalnya, CVE di persentil ke-95 berdasarkan skor EPSS-nya lebih mungkin dieksploitasi daripada 95% CVE lainnya. Dengan demikian, persentil digunakan untuk membandingkan skor EPSS suatu CVE dengan CVE lainnya.
Produk yang Disebutkan
Konfigurasi 0
Gnu>>Tar >> Version 1.13.25
Konfigurasi 0
Redhat>>Enterprise_linux >> Version 2.1
Redhat>>Enterprise_linux >> Version 2.1
Redhat>>Enterprise_linux >> Version 2.1
Redhat>>Enterprise_linux >> Version 2.1
Redhat>>Enterprise_linux >> Version 2.1
Redhat>>Enterprise_linux >> Version 2.1
Redhat>>Enterprise_linux >> Version 3.0
Redhat>>Enterprise_linux >> Version 3.0
Redhat>>Enterprise_linux >> Version 3.0
Redhat>>Enterprise_linux_desktop >> Version 3.0
Redhat>>Linux_advanced_workstation >> Version 2.1
Redhat>>Linux_advanced_workstation >> Version 2.1
Referensi
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9946
Tags : vdb-entry, signature, x_refsource_OVAL
Tags : vdb-entry, signature, x_refsource_OVAL
http://www.novell.com/linux/security/advisories/2006_05_sr.html
Tags : vendor-advisory, x_refsource_SUSE
Tags : vendor-advisory, x_refsource_SUSE
http://www.securityfocus.com/archive/1/430297/100/0/threaded
Tags : vendor-advisory, x_refsource_FEDORA
Tags : vendor-advisory, x_refsource_FEDORA
ftp://patches.sgi.com/support/free/security/advisories/20060301-01.U.asc
Tags : vendor-advisory, x_refsource_SGI
Tags : vendor-advisory, x_refsource_SGI
