NVD

Id
3204  
Name
CVE-2008-3323  
Description
setup.exe before 2.573.2.3 in Cygwin does not properly verify the authenticity of packages, which allows remote Cygwin mirror servers or man-in-the-middle attackers to execute arbitrary code via a package list containing the MD5 checksum of a Trojan horse package.  
Reject
 
CVSS Version
2  
CVSS Score
7.6  
Severity
High  
CVSS Base Score
7.6  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-03  
Published
2008-07-28  
Modified Date
2011-03-07  
Seq
2008-3323  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
20316 3204 CVE-2008-3323 [cygwin-announce] 20080805 Updated: Setup.exe updated to version 2.573.2.3  View
20317 3204 CVE-2008-3323 4051  View
20318 3204 CVE-2008-3323 http://www.security-objectives.com/advisories/SECOBJADV-2008-02.txt  View
20319 3204 CVE-2008-3323 20080725 SECOBJADV-2008-02: Cygwin Installation and Update Process can be Subverted Vulnerability  View
20320 3204 CVE-2008-3323 30375  View
20321 3204 CVE-2008-3323 ADV-2008-2321  View
20322 3204 CVE-2008-3323 cygwin-setup-weak-security(44047)  View
20323 3204 CVE-2008-3323 https://bugzilla.redhat.com/show_bug.cgi?id=449929  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
50751 JVNDB-2008-006061 Cygwin の setup.exe における任意のコードを実行される脆弱性 Cygwin の setup.exe は、パッケージの信頼性を適切に検証しないため、任意のコードを実行される脆弱性が存在します。 CVE-2008-3323 33436 CVE-2008-3323 3204 7.6 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-006061.html 2008-07-28 2012-12-20 View