SilverCity Insecure File Permissions Vulnerability
BID:13894
Info
SilverCity Insecure File Permissions Vulnerability
| Bugtraq ID: | 13894 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 08 2005 12:00AM |
| Updated: | Jun 08 2005 12:00AM |
| Credit: | This issue was announced in a Gentoo advisory. |
| Vulnerable: |
SilverCity SilverCity 0.9.4 Gentoo Linux |
| Not Vulnerable: |
SilverCity SilverCity 0.9.5 -r1 |
Discussion
SilverCity Insecure File Permissions Vulnerability
The SilverCity installation package is reported prone to a vulnerability. Reports indicate that when SilverCity is installed three of the SilverCity executables are installed with insecure permissions.
An attacker that had local access to a vulnerable computer may modify the SilverCity executables and replace them with trojaned versions.
The SilverCity installation package is reported prone to a vulnerability. Reports indicate that when SilverCity is installed three of the SilverCity executables are installed with insecure permissions.
An attacker that had local access to a vulnerable computer may modify the SilverCity executables and replace them with trojaned versions.
Exploit / POC
SilverCity Insecure File Permissions Vulnerability
No exploit is required.
No exploit is required.
Solution / Fix
SilverCity Insecure File Permissions Vulnerability
Solution:
Gentoo has released an advisory (GLSA 200506-05) and an updated eBuild to address this issue. Gentoo users that have the SilverCity utility installed may apply this update by invoking the following sequence of commands as a superuser:
emerge --sync
emerge --ask --oneshot --verbose ">=app-text/silvercity-0.9.5-r1"
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Gentoo has released an advisory (GLSA 200506-05) and an updated eBuild to address this issue. Gentoo users that have the SilverCity utility installed may apply this update by invoking the following sequence of commands as a superuser:
emerge --sync
emerge --ask --oneshot --verbose ">=app-text/silvercity-0.9.5-r1"
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.