6.9

CVE-2012-2095

Exploit
The SetWiredProperty function in the D-Bus interface in WICD before 1.7.2 allows local users to write arbitrary configuration settings and gain privileges via a crafted property name in a dbus message.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
David Paleino ≫ Wicd Version <= 1.7.1
David Paleino ≫ Wicd Version 1.2.7
David Paleino ≫ Wicd Version 1.3.1
David Paleino ≫ Wicd Version 1.4.0
David Paleino ≫ Wicd Version 1.4.1
David Paleino ≫ Wicd Version 1.4.2
David Paleino ≫ Wicd Version 1.5.0
David Paleino ≫ Wicd Version 1.5.1
David Paleino ≫ Wicd Version 1.5.2
David Paleino ≫ Wicd Version 1.5.3
David Paleino ≫ Wicd Version 1.5.4
David Paleino ≫ Wicd Version 1.5.5
David Paleino ≫ Wicd Version 1.5.6
David Paleino ≫ Wicd Version 1.5.7
David Paleino ≫ Wicd Version 1.5.8
David Paleino ≫ Wicd Version 1.5.9
David Paleino ≫ Wicd Version 1.6.0
David Paleino ≫ Wicd Version 1.6.2
David Paleino ≫ Wicd Version 1.7.0
David Paleino ≫ Wicd Version 1.7.1 Update beta3
Fedoraproject ≫ Fedora Version 15
Fedoraproject ≫ Fedora Version 16
Fedoraproject ≫ Fedora Version 17
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.8% 0.522
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.9 3.4 10
AV:L/AC:M/Au:N/C:C/I:C/A:C
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://secunia.com/advisories/49657
Vendor Advisory
http://bazaar.launchpad.net/~wicd-devel/wicd/experimental/revision/751
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=668397
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079025.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079029.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079055.html
http://secunia.com/advisories/48759
Vendor Advisory
http://www.exploit-db.com/exploits/18733
Exploit
http://www.gentoo.org/security/en/glsa/glsa-201206-08.xml
http://www.infosecinstitute.com/courses/ethical-hacking-wicd-0day.html
http://www.openwall.com/lists/oss-security/2012/04/11/2
http://www.openwall.com/lists/oss-security/2012/04/11/3
http://www.securityfocus.com/bid/52987
https://bugs.launchpad.net/wicd/+bug/979221
https://launchpad.net/wicd/+announcement/9888