|
|
|
View Notes By
|
|
|
|
Other Documents
|
|
|
|
|
Cray Inc. Information for VU#336083
| Date Notified: | 2002-07-15 |
| Date Updated: | |
| Statement Date: | |
| Status Summary: | Vulnerable |
Vendor StatementCray, Inc. is vulnerable however it is by design and will remain that way to maintain POSIX compliancy. According to the POSIX standards for uudecode:
"If the pathname of the file to be produced exists, and the user does not have write permission on the file, uudecode will terminate with an error. If the pathname of the file to be produced exists, and the user has write permission on that file, the existing file will be overwritten."
So, if a user has root write permission then yes they can overwrite a file using uudecode (or cat, or other various unix commands).Vendor InformationThe vendor has not provided us with any further information regarding this vulnerability.
AddendumThe CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us
email.
|
 |
