Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2008-0167 | First vendor Publication | 2008-05-18 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 4.6 | Attack Range | Local |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 3.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| The write_array_file function in utils/include.pl in GForge 4.5.14 updates configuration files by truncating them to zero length and then writing new data, which might allow attackers to bypass intended access restrictions or have unspecified other impact in opportunistic circumstances. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0167 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-59 | Improper Link Resolution Before File Access ('Link Following') |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:20030 | |||
| Oval ID: | oval:org.mitre.oval:def:20030 | ||
| Title: | DSA-1577-1 gforge - insecure temporary files | ||
| Description: | Stephen Gran and Mark Hymers discovered that some scripts run by GForge, a collaborative development tool, open files in write mode in a potentially insecure manner. This may be exploited to overwrite arbitrary files on the local system. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1577-1 CVE-2008-0167 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | gforge |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2008-05-27 | Name : Debian Security Advisory DSA 1577-1 (gforge) File : nvt/deb_1577_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 45265 | GForge Insecure Temporary Files Unspecified Symlink Arbitrary File Overwrite |
| 42135 | phpQLAdmin ezmlm.php _SESSION[path] Parameter Remote File Inclusion phpQLAdmin contains a flaw that may allow a remote attacker to execute arbitrary commands. The issue is due to 'ezmlm.php' not properly sanitizing user input supplied to the '_SESSION[path]' variable. This may allow an attacker to include a file from a remote host that contains arbitrary commands which will be executed by the vulnerable script. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2008-05-19 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1577.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:14:21 |
|
| 2024-11-28 12:14:31 |
|
| 2020-05-23 00:21:05 |
|
| 2017-08-08 09:23:48 |
|
| 2016-06-28 23:57:59 |
|
| 2016-04-26 17:00:10 |
|
| 2014-02-17 10:43:23 |
|
| 2013-05-11 00:06:19 |
|
