NVD

Id
12965  
Name
CVE-2010-1438  
Description
Web Application Finger Printer (WAFP) 0.01-26c3 uses fixed pathnames under /tmp for temporary files and directories, which (1) allows local users to cause a denial of service (application outage) by creating a file with a pathname that the product expects is available for its own internal use, (2) allows local users to overwrite arbitrary files via symlink attacks on certain files in /tmp, (3) might allow local users to delete arbitrary files and directories via a symlink attack on a directory under /tmp, and (4) might make it easier for local users to obtain sensitive information by reading files in a directory under /tmp, related to (a) lib/wafp_pidify.rb, (b) utils/generate_wafp_fingerprint.sh, (c) utils/online_update.sh, and (d) utils/extract_from_db.sh.  
Reject
 
CVSS Version
2  
CVSS Score
4.4  
Severity
Medium  
CVSS Base Score
4.4  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2010-05-06  
Modified Date
2010-05-11  
Seq
2010-1438  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
71809 12965 CVE-2010-1438 http://code.google.com/p/webapplicationfingerprinter/issues/detail?id=8  View
71810 12965 CVE-2010-1438 [oss-security] 20100427 wafp insecure temporary directory  View
71811 12965 CVE-2010-1438 [oss-security] 20100427 Re: wafp insecure temporary directory  View
71812 12965 CVE-2010-1438 39760  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
38884 JVNDB-2010-004669 WAFP におけるサービス運用妨害 (DoS) などの脆弱性 Web Application Finger Printer (WAFP) は、テンポラリファイルおよびディレクトリ用に /tmp という固定されたパス名を使用し、以下に関する処理に不備があるため、(1) サービス運用妨害 (アプリケーション停止) 状態となる、(2) 任意のファイルを上書きされる、(3) 任意のファイルおよびディレクトリを削除される、および (4) 重要な情報を取得される脆弱性が存在します。 CVE-2010-1438 44018 CVE-2010-1438 12965 4.4 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-004669.html 2010-05-06 2012-09-25 View