CVE-2011-3602

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2011-3602
Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd) before 1.8.2 allows local users to overwrite arbitrary files, and remote attackers to overwrite certain files, via a .. (dot dot) in an interface name. NOTE: this can be leveraged with a symlink to overwrite arbitrary files.

6.4 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:P

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://www.debian.org/security/2011/dsa-2323
http://www.litech.org/radvd/CHANGES
http://www.openwall.com/lists/oss-security/2011/10/06/3
http://www.ubuntu.com/usn/USN-1257-1 Vendor Advisory
https://github.com/reubenhwk/radvd/commit/92e22ca23e52066da2258df8c76a2dca8a428bcc
Configurations

Configuration 1 (hide)

cpe:2.3:a:litech:router_advertisement_daemon:*:*:*:*:*:*:*:*
History

07 Nov 2023, 02:08

Type Values Removed Values Added
Summary Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd) before 1.8.2 allows local users to overwrite arbitrary files, and remote attackers to overwrite certain files, via a .. (dot dot) in an interface name. NOTE: this can be leveraged with a symlink to overwrite arbitrary files. Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd) before 1.8.2 allows local users to overwrite arbitrary files, and remote attackers to overwrite certain files, via a .. (dot dot) in an interface name. NOTE: this can be leveraged with a symlink to overwrite arbitrary files.

13 Feb 2023, 01:20

Type Values Removed Values Added
Summary Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd) before 1.8.2 allows local users to overwrite arbitrary files, and remote attackers to overwrite certain files, via a .. (dot dot) in an interface name. NOTE: this can be leveraged with a symlink to overwrite arbitrary files. Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd) before 1.8.2 allows local users to overwrite arbitrary files, and remote attackers to overwrite certain files, via a .. (dot dot) in an interface name. NOTE: this can be leveraged with a symlink to overwrite arbitrary files.
Information

Published : 2014-04-27 21:55

Updated : 2023-12-10 11:31

NVD link : CVE-2011-3602

Mitre link : CVE-2011-3602

CVE.ORG link : CVE-2011-3602

JSON object : View

Products Affected

litech

  • router_advertisement_daemon
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')