Vulnerability Name:

CVE-2002-0658 (CCN-9719)

Assigned:2002-07-29
Published:2002-07-29
Updated:2013-09-04
Summary:OSSP mm library (libmm) before 1.2.0 allows the local Apache user to gain privileges via temporary files, possibly via a symbolic link attack.
CVSS v3 Severity:4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:6.2 Medium (CVSS v2 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
2.6 Low (CCN CVSS v2 Vector: AV:L/AC:H/Au:N/C:N/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:File Manipulation
References:Source: CALDERA
Type: UNKNOWN
CSSA-2002-032.0

Source: CCN
Type: Caldera International, Inc. Security Advisory CSSA-2002-032.0
temporary file races in libmm

Source: CCN
Type: FreeBSD Security Notice FreeBSD-SN-02:05
security issues in ports

Source: FREEBSD
Type: UNKNOWN
FreeBSD-SN-02:05

Source: MITRE
Type: CNA
CVE-2002-0658

Source: HP
Type: UNKNOWN
HPSBTL0208-056

Source: CCN
Type: RHSA-2002-153
Updated mm packages fix temporary file handling

Source: REDHAT
Type: UNKNOWN
RHSA-2002:153

Source: CCN
Type: RHSA-2002-154
mm security update

Source: REDHAT
Type: UNKNOWN
RHSA-2002:154

Source: REDHAT
Type: UNKNOWN
RHSA-2002:156

Source: REDHAT
Type: UNKNOWN
RHSA-2002:164

Source: CCN
Type: RHSA-2003-158
Updated mm packages fix temporary file handling

Source: CCN
Type: CIAC Information Bulletin 0-171
Hewlett Packard OpenSSL Potential Vulnerabilities

Source: DEBIAN
Type: UNKNOWN
DSA-137

Source: DEBIAN
Type: DSA-137
mm -- insecure temporary files

Source: XF
Type: UNKNOWN
mm-tmpfile-symlink(9719)

Source: MANDRAKE
Type: Patch, Vendor Advisory
MDKSA-2002:045

Source: SUSE
Type: UNKNOWN
SuSE-SA:2002:028

Source: CCN
Type: OpenPKG-SA-2002.007
OSSP mm

Source: CCN
Type: OSSP. Unix Software Technologies Web site
OSSP - OSSP mm

Source: REDHAT
Type: UNKNOWN
RHSA-2002:163

Source: REDHAT
Type: UNKNOWN
RHSA-2003:158

Source: BID
Type: UNKNOWN
5352

Source: CCN
Type: BID-5352
MM Shared Memory Library Temporary File Privilege Escalation Vulnerability

Source: XF
Type: UNKNOWN
mm-tmpfile-symlink(9719)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:ossp:mm:1.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ossp:mm:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:ossp:mm:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:ossp:mm:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:ossp:mm:1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:ossp:mm:1.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:ossp:mm:1.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:ossp:mm:1.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:ossp:mm:1.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:ossp:mm:1.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:ossp:mm:1.0.10:*:*:*:*:*:*:*
  • OR cpe:/a:ossp:mm:1.0.11:*:*:*:*:*:*:*
  • OR cpe:/a:ossp:mm:1.0.12:*:*:*:*:*:*:*
  • OR cpe:/a:ossp:mm:1.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ossp:mm:1.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:ossp:mm:1.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:ossp:mm:1.1.3:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:hp:hp-ux:11.00:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:2.2:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:7.1:*:*:*:*:*:*:*
  • OR cpe:/o:freebsd:ports_collection:*:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7:*:*:*:*:*:*:*
  • OR cpe:/o:hp:hp-ux:11.11:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:7.2:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:8.0:*:*:*:*:*:*:*
  • OR cpe:/a:mandrakesoft:mandrake_single_network_firewall:7.2:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:8.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.2:*:*:*:*:*:*:*
  • OR cpe:/o:hp:hp-ux:11.20:*:*:*:*:*:*:*
  • OR cpe:/a:openpkg:openpkg:1.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:8.2:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.3:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:3.0:*:*:*:*:*:*:*
  • OR cpe:/a:openpkg:openpkg:current:*:*:*:*:*:*:*
  • OR cpe:/o:hp:hp-ux:11.22:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.1:*:*:*:*:*:pseries:*
  • OR cpe:/o:redhat:linux:7.1:*:*:*:*:*:iseries:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:8.0:*:ppc:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:8.1:*:ia64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:8.2:*:ppc:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.debian:def:137
    V
    		insecure temporary files
    2002-07-30
    BACK
    ossp mm 1.0.0
    ossp mm 1.0.1
    ossp mm 1.0.2
    ossp mm 1.0.3
    ossp mm 1.0.4
    ossp mm 1.0.5
    ossp mm 1.0.6
    ossp mm 1.0.7
    ossp mm 1.0.8
    ossp mm 1.0.9
    ossp mm 1.0.10
    ossp mm 1.0.11
    ossp mm 1.0.12
    ossp mm 1.1.0
    ossp mm 1.1.1
    ossp mm 1.1.2
    ossp mm 1.1.3
    hp hp-ux 11.00
    debian debian linux 2.2
    mandrakesoft mandrake linux 7.1
    freebsd ports collection *
    redhat linux 7
    hp hp-ux 11.11
    mandrakesoft mandrake linux 7.2
    mandrakesoft mandrake linux corporate server 1.0.1
    redhat linux 7.1
    mandrakesoft mandrake linux 8.0
    mandrakesoft mandrake single network firewall 7.2
    mandrakesoft mandrake linux 8.1
    redhat linux 7.2
    hp hp-ux 11.20
    openpkg openpkg 1.0
    mandrakesoft mandrake linux 8.2
    redhat linux 7.3
    debian debian linux 3.0
    openpkg openpkg current
    hp hp-ux 11.22
    redhat enterprise linux 2.1
    redhat linux 7.1
    redhat linux 7.1
    mandrakesoft mandrake linux 8.0
    mandrakesoft mandrake linux 8.1
    mandrakesoft mandrake linux 8.2