Lucene search

OracleCVE-2013-1495

HistoryMar 18, 2013 - 9:55 p.m.

CVE-2013-1495

2013-03-1821:55:01

CWE-59

oracle

web.nvd.nist.gov

cve

2013

1495

oracle

auto service request

symlink attack

vulnerability

nvd

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

AI Score

6.1

Confidence

Low

EPSS

0.001

Percentile

26.5%

JSON

asr in Oracle Auto Service Request in Oracle Support Tools before 4.3.2 allows local users to modify arbitrary files via a symlink attack on a predictable filename in /tmp.

Affected configurations

Nvd

Node

oraclesupport_toolsRange≤4.3.2

VendorProductVersionCPE
oraclesupport_tools*cpe:2.3:a:oracle:support_tools:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
oracle	support_tools	*	cpe:2.3:a:oracle:support_tools::::::::

References

seclists.org/fulldisclosure/2013/Feb/159

www.mandriva.com/security/advisories?name=MDVSA-2013:150

www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

AI Score

6.1

Confidence

Low

EPSS

0.001

Percentile

26.5%

JSON

Related for CVE-2013-1495