CVE-2010-3387

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2010-3387
vdrleaktest in Video Disk Recorder (VDR) 1.6.0 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. NOTE: a third party disputes this issue because the script erroneously uses a semicolon in a context where a colon was intended

6.9 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 3.4 / Impact : 10.0

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598308 Exploit Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:tvdr:vdr:1.6.0:*:*:*:*:*:*:*
History

07 Nov 2023, 02:05

Type Values Removed Values Added
Summary ** DISPUTED ** vdrleaktest in Video Disk Recorder (VDR) 1.6.0 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. NOTE: a third party disputes this issue because the script erroneously uses a semicolon in a context where a colon was intended. vdrleaktest in Video Disk Recorder (VDR) 1.6.0 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. NOTE: a third party disputes this issue because the script erroneously uses a semicolon in a context where a colon was intended
Information

Published : 2010-10-20 18:00

Updated : 2024-04-11 00:47

NVD link : CVE-2010-3387

Mitre link : CVE-2010-3387

CVE.ORG link : CVE-2010-3387

JSON object : View

Products Affected

tvdr

  • vdr
CWE
NVD-CWE-Other