PRIOn knowledge basePRION:CVE-2013-1976

HistoryJul 09, 2013 - 5:55 p.m.

Input validation

2013-07-0917:55:00

PRIOn knowledge base

www.prio-n.com

6.7 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

The (1) tomcat5, (2) tomcat6, and (3) tomcat7 init scripts, as used in the RPM distribution of Tomcat for JBoss Enterprise Web Server 1.0.2 and 2.0.0, and Red Hat Enterprise Linux 5 and 6, allow local users to change the ownership of arbitrary files via a symlink attack on (a) tomcat5-initd.log, (b) tomcat6-initd.log, © catalina.out, or (d) tomcat7-initd.log.

CPENameOperatorVersion
enterprise_linuxeq6.0
enterprise_linuxeq5
jboss_enterprise_web_servereq1.0.2
jboss_enterprise_web_servereq2.0.0

Name	Operator	Version
enterprise_linux	eq	6.0
enterprise_linux	eq	5
jboss_enterprise_web_server	eq	1.0.2
jboss_enterprise_web_server	eq	2.0.0

References

lists.opensuse.org/opensuse-updates/2013-08/msg00013.html

rhn.redhat.com/errata/RHSA-2013-0869.html

rhn.redhat.com/errata/RHSA-2013-0870.html

rhn.redhat.com/errata/RHSA-2013-0871.html

rhn.redhat.com/errata/RHSA-2013-0872.html

bugzilla.redhat.com/show_bug.cgi?id=927622