Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2011-2185

Overview

Vulnerability Score 4.4 4.4
CVE Id CVE-2011-2185
Last Modified 02 Aug 2011 12:00:00
Published 26 Jul 2011 10:55:01
Confidentiality Impact PARTIAL PARTIAL
Integrity Impact PARTIAL PARTIAL
Availability Impact PARTIAL PARTIAL
Access Vector LOCAL
Access Complexity MEDIUM
Authentication NONE

CVE-2011-2185

Summary

Fabric before 1.1.0 allows local users to overwrite arbitrary files via a symlink attack on (1) a /tmp/fab.*.tar file or (2) certain other files in the top level of /tmp/.

Vulnerable Systems

Application

  • Fabfile Fabric 0.9

  • Fabfile Fabric 0.9.1

  • Fabfile Fabric 0.9.2

  • Fabfile Fabric 0.9.3

  • Fabfile Fabric 0.9.4

  • Fabfile Fabric 0.9.5

  • Fabfile Fabric 0.9.6

  • Fabfile Fabric 0.9.7

  • Fabfile Fabric 1.0.0

  • Fabfile Fabric 1.0.1

  • Fabfile Fabric 1.0.2


References

CONFIRM - http://code.fabfile.org/projects/fabric/files/Fabric-1.1.0.tar.gz

CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=710462

MLIST - [oss-security] 20110606 Re: CVE Request -- fabric -- Use of insecure temporary file by uploading templates and projects to remote hosts

MLIST - [oss-security] 20110603 CVE Request -- fabric -- Use of insecure temporary file by uploading templates and projects to remote hosts

FEDORA - FEDORA-2011-8964

CONFIRM - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629003


Last Updated: 27 May 2016 10:56:57