NVD Vulnerability Detail

CVE-2011-4328

Summary	plugin/npapi/plugin.cpp in Gnash before 0.8.10 uses weak permissions (world readable) for cookie files with predictable names in /tmp, which allows local users to obtain sensitive information.
Publication Date	June 16, 2012, 9:55 a.m.
Registration Date	Jan. 28, 2021, 4:39 p.m.
Last Update	Nov. 21, 2024, 10:32 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=649384
2	http://git.savannah.gnu.org/gitweb/?p=gnash.git%3Ba=commitdiff%3Bh=fa481c116e65ccf9137c7ddc8abc3cf05dc12f55
3	http://lists.opensuse.org/opensuse-updates/2012-03/msg00003.html
4	http://lists.opensuse.org/opensuse-updates/2012-03/msg00026.html
5	http://secunia.com/advisories/48325	Vendor Advisory
6	http://secunia.com/advisories/48466	Vendor Advisory
7	http://www.debian.org/security/2012/dsa-2435
8	http://www.openwall.com/lists/oss-security/2011/11/21/12
9	http://www.openwall.com/lists/oss-security/2011/11/21/7
10	http://www.osvdb.org/77243
11	http://www.securityfocus.com/bid/50747
12	https://bugzilla.redhat.com/show_bug.cgi?id=755518
13	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=649384
14	https://bugzilla.redhat.com/show_bug.cgi?id=755518
15	http://www.securityfocus.com/bid/50747
16	http://www.osvdb.org/77243
17	http://www.openwall.com/lists/oss-security/2011/11/21/7
18	http://www.openwall.com/lists/oss-security/2011/11/21/12
19	http://www.debian.org/security/2012/dsa-2435
20	http://secunia.com/advisories/48466	Vendor Advisory
21	http://secunia.com/advisories/48325	Vendor Advisory
22	http://lists.opensuse.org/opensuse-updates/2012-03/msg00026.html
23	http://lists.opensuse.org/opensuse-updates/2012-03/msg00003.html
24	http://git.savannah.gnu.org/gitweb/?p=gnash.git%3Ba=commitdiff%3Bh=fa481c116e65ccf9137c7ddc8abc3cf05dc12f55

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-264	認可・権限・アクセス制御	https://cwe.mitre.org/data/definitions/264.html

JVN Vulnerability Information

Gnash の plugin/npapi/plugin.cpp における重要な情報を取得される脆弱性

Title	Gnash の plugin/npapi/plugin.cpp における重要な情報を取得される脆弱性
Summary	Gnash の plugin/npapi/plugin.cpp が使用する /tmp のクッキーファイルは、予測可能なファイル名を持ち、脆弱なアクセス許可 (world readable) を与えられているため、重要な情報を取得される脆弱性が存在します。
Possible impacts	ローカルユーザにより、重要な情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 16, 2012, midnight
Registration Date	June 20, 2012, 10:35 a.m.
Last Update	June 20, 2012, 10:35 a.m.

Affected System

GNU Project

Gnash 0.8.10 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-4328	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4328
National Vulnerability Database (NVD)
2	CVE-2011-4328	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4328

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	Name	URL
Debian Security Advisory
1	DSA-2435	http://www.debian.org/security/2012/dsa-2435
Gnash Project
2	Top Page	http://www.gnashdev.org/
GnuPG Project
3	gnash.git / commitdiff	http://git.savannah.gnu.org/gitweb/?p=gnash.git;a=commitdiff;h=fa481c116e65ccf9137c7ddc8abc3cf05dc12f55
opensuse-security-announce
4	openSUSE-SU-2012:0330	http://lists.opensuse.org/opensuse-updates/2012-03/msg00003.html
5	openSUSE-SU-2012:0369	http://lists.opensuse.org/opensuse-updates/2012-03/msg00026.html

Change Log

No	Changed Details	Date of change
0	[2012年06月20日] 掲載	Feb. 17, 2018, 10:37 a.m.