7.8

CVE-2009-3289

Exploit
The g_file_copy function in glib 2.0 sets the permissions of a target file to the permissions of a symbolic link (777), which allows user-assisted local users to modify files of other users, as demonstrated by using Nautilus to modify the permissions of the user home directory.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gnome ≫ Glib Version2.0
Opensuse ≫ Opensuse Version11.0
Opensuse ≫ Opensuse Version11.1
Suse ≫ Suse Linux Enterprise Server Version11 Update-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.36% 0.276
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 4.4 3.4 6.4
AV:L/AC:M/Au:N/C:P/I:P/A:P
CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html
Third Party Advisory
http://secunia.com/advisories/39656
Broken Link
http://www.openwall.com/lists/oss-security/2009/09/08/8
Mailing List
http://www.vupen.com/english/advisories/2010/1001
Permissions Required
https://bugs.launchpad.net/ubuntu/+source/glib2.0/+bug/418135
Exploit
Issue Tracking
https://bugzilla.gnome.org/show_bug.cgi?id=593406
Exploit
Issue Tracking