CVE-2009-5023 : Detail

CVE-2009-5023

0.04%V4
2014-06-10
14h00 +00:00
A01-Broken Access Control
Local
2024-08-07
07h24 +00:00
Notifikasi untuk CVE tertentu
Tetap terinformasi tentang perubahan untuk CVE tertentu.
Kelola notifikasi

Deskripsi CVE

The (1) dshield.conf, (2) mail-buffered.conf, (3) mynetwatchman.conf, and (4) mynetwatchman.conf actions in action.d/ in Fail2ban before 0.8.5 allows local users to write to arbitrary files via a symlink attack on temporary files with predictable names, as demonstrated by /tmp/fail2ban-mail.txt.

Informasi CVE

Kelemahan Terkait

CWE-ID Nama Kelemahan Sumber
CWE-59 Improper Link Resolution Before File Access
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Metrik

Metrik Skor Tingkat keparahan CVSS Vektor Sumber
V2 4.7 AV:L/AC:M/Au:N/C:N/I:C/A:N nvd@nist.gov

EPSS

EPSS adalah model penilaian yang memprediksi kemungkinan suatu kerentanan dieksploitasi.

Skor EPSS

Model EPSS menghasilkan skor probabilitas antara 0 dan 1 (0 hingga 100%). Semakin tinggi skor, semakin besar probabilitas bahwa suatu kerentanan akan dieksploitasi.

Persentil EPSS

Persentil digunakan untuk meranking CVE berdasarkan skor EPSS mereka. Misalnya, CVE di persentil ke-95 berdasarkan skor EPSS-nya lebih mungkin dieksploitasi daripada 95% CVE lainnya. Dengan demikian, persentil digunakan untuk membandingkan skor EPSS suatu CVE dengan CVE lainnya.

Produk yang Disebutkan

Konfigurasi 0

Fail2ban>>Fail2ban >> Version Hingga (termasuk) 0.8.4

Fail2ban>>Fail2ban >> Version 0.1.0

Fail2ban>>Fail2ban >> Version 0.1.1

Fail2ban>>Fail2ban >> Version 0.1.2

Fail2ban>>Fail2ban >> Version 0.3.0

Fail2ban>>Fail2ban >> Version 0.3.1

Fail2ban>>Fail2ban >> Version 0.4.0

Fail2ban>>Fail2ban >> Version 0.4.1

Fail2ban>>Fail2ban >> Version 0.5.0

Fail2ban>>Fail2ban >> Version 0.5.1

Fail2ban>>Fail2ban >> Version 0.5.2

Fail2ban>>Fail2ban >> Version 0.5.3

Fail2ban>>Fail2ban >> Version 0.5.4

Fail2ban>>Fail2ban >> Version 0.5.5

Fail2ban>>Fail2ban >> Version 0.6.0

Fail2ban>>Fail2ban >> Version 0.6.1

Fail2ban>>Fail2ban >> Version 0.7.0

Fail2ban>>Fail2ban >> Version 0.7.1

Fail2ban>>Fail2ban >> Version 0.7.2

Fail2ban>>Fail2ban >> Version 0.7.3

Fail2ban>>Fail2ban >> Version 0.7.4

Fail2ban>>Fail2ban >> Version 0.7.5

Fail2ban>>Fail2ban >> Version 0.7.6

Fail2ban>>Fail2ban >> Version 0.7.7

Fail2ban>>Fail2ban >> Version 0.7.8

Fail2ban>>Fail2ban >> Version 0.7.9

Fail2ban>>Fail2ban >> Version 0.8.0

Fail2ban>>Fail2ban >> Version 0.8.1

Fail2ban>>Fail2ban >> Version 0.8.2

Fail2ban>>Fail2ban >> Version 0.8.3

Referensi

http://security.gentoo.org/glsa/glsa-201406-03.xml
Tags : vendor-advisory, x_refsource_GENTOO
http://secunia.com/advisories/58841
Tags : third-party-advisory, x_refsource_SECUNIA