« IntelDatasetRejected:apache2 » : différence entre les versions
Aller à la navigation
Aller à la recherche
m Révocation d’une modification réalisée par HackBBS (discussion) et restauration de la dernière version réalisée par Korigan Balise : Révocation |
Aucun résumé des modifications |
||
| Ligne 4 : | Ligne 4 : | ||
"author": "korigan",<br /> | "author": "korigan",<br /> | ||
"comment": "This is part of the try_chown function.\nThis function is called by socache_dbm_init when the superuser run the program only.\nThe files impacted are {db, dir, pag} files. Those suffixes are hardcoded and cannot be manipulated.\nThose files contains non executable data only.\nAn attacker would need to already have root privs or already have the low privileges required to access the targeted data files.\nThis entry cannot lead to an RCE."<br /> | "comment": "This is part of the try_chown function.\nThis function is called by socache_dbm_init when the superuser run the program only.\nThe files impacted are {db, dir, pag} files. Those suffixes are hardcoded and cannot be manipulated.\nThose files contains non executable data only.\nAn attacker would need to already have root privs or already have the low privileges required to access the targeted data files.\nThis entry cannot lead to an RCE."<br /> | ||
},<br /> | |||
{<br /> | |||
"description": "./srclib/apr/file_io/unix/filestat.c:179: [5] (race) chmod: This accepts filename arguments; if an attacker can move those files, a race condition results. (CWE-362). Use fchmod( ) instead.",<br /> | |||
"author": "korigan",<br /> | |||
"comment": "File not found"<br /> | |||
}<br /> | }<br /> | ||
] | ] | ||
Version du 10 septembre 2024 à 17:55
[
{
"description": "./modules/cache/mod_socache_dbm.c:106: [5] (race) chown: This accepts filename arguments; if an attacker can move those files, a race condition results. (CWE-362). Use fchown( ) instead.",
"author": "korigan",
"comment": "This is part of the try_chown function.\nThis function is called by socache_dbm_init when the superuser run the program only.\nThe files impacted are {db, dir, pag} files. Those suffixes are hardcoded and cannot be manipulated.\nThose files contains non executable data only.\nAn attacker would need to already have root privs or already have the low privileges required to access the targeted data files.\nThis entry cannot lead to an RCE."
},
{
"description": "./srclib/apr/file_io/unix/filestat.c:179: [5] (race) chmod: This accepts filename arguments; if an attacker can move those files, a race condition results. (CWE-362). Use fchmod( ) instead.",
"author": "korigan",
"comment": "File not found"
}
]