| Vulnerability Name: | CVE-2011-1920 (CCN-67495) | ||||||||
| Assigned: | 2011-05-16 | ||||||||
| Published: | 2011-05-16 | ||||||||
| Updated: | 2017-08-17 | ||||||||
| Summary: | The make include files in NetBSD before 1.6.2, as used in pmake 1.111 and other products, allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_depend##### temporary file, related to (1) bsd.lib.mk and (2) bsd.prog.mk. | ||||||||
| CVSS v3 Severity: | 5.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 3.3 Low (CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:P/A:P) 2.9 Low (Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:P/A:P/E:H/RL:OF/RC:C)
2.9 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:P/A:P/E:H/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-59 | ||||||||
| Vulnerability Consequences: | File Manipulation | ||||||||
| References: | Source: CONFIRM Type: Exploit, Patch http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=626673 Source: MITRE Type: CNA CVE-2011-1920 Source: CONFIRM Type: Patch http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.lib.mk.diff?r1=1.239&r2=1.240&f=h Source: CONFIRM Type: Patch http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.prog.mk.diff?r1=1.192&r2=1.193&f=h Source: MLIST Type: Exploit, Patch [oss-security] 20110516 CVE Request -- pmake -- Use of insecure temporary file for 'depend' target Source: MLIST Type: Patch [oss-security] 20110516 Re: CVE Request -- pmake -- Use of insecure temporary file for 'depend' target Source: CCN Type: Pmake Web site Pmake Source: CCN Type: OSVDB ID: 73859 pmake Make Include Files /tmp/_depend* Temporary File Symlink Arbitrary File Ovewrite Source: BID Type: UNKNOWN 47878 Source: CCN Type: BID-47878 Pmake Insecure Temporary File Creation Vulnerability Source: CCN Type: Red Hat Bugzilla Bug 705090 pmake: Use of insecure temporary file for 'depend' target Source: CONFIRM Type: Exploit, Patch https://bugzilla.redhat.com/show_bug.cgi?id=705090 Source: CONFIRM Type: Patch https://bugzilla.redhat.com/show_bug.cgi?id=705100 Source: XF Type: UNKNOWN pmake-depend-symlink(67495) Source: XF Type: UNKNOWN pmake-depend-symlink(67495) | ||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||