1. CVE-Search
  2. CVE-2010-2953
ID CVE-2010-2953
Summary Untrusted search path vulnerability in a certain Debian GNU/Linux patch for the couchdb script in CouchDB 0.8.0 allows local users to gain privileges via a crafted shared library in the current working directory. Per: http://cwe.mitre.org/data/definitions/426.html 'CWE-426: Untrusted Search Path'
References
Vulnerable Configurations
  • cpe:2.3:a:apache:couchdb:0.8.0:*:*:*:*:*:*:*
    cpe:2.3:a:apache:couchdb:0.8.0:*:*:*:*:*:*:*
CVSS
Base: 6.9 (as of 14-09-2010 - 19:00)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
LOCAL MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:L/AC:M/Au:N/C:C/I:C/A:C
refmap via4
bid 42758
confirm http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=594412
debian DSA-2107
misc http://www.nth-dimension.org.uk/blog.php?id=87
mlist
  • [oss-security] 20100825 CVE request: CouchDB insecure library loading (Debian/Ubuntu only)
  • [oss-security] 20100826 Re: CVE request: CouchDB insecure library loading (Debian/Ubuntu only)
  • [oss-security] 20100829 Hardening the linker (was Re: CVE request: CouchDB insecure library loading (Debian/Ubuntu only))
secunia 41383
vupen ADV-2010-2341
Last major update 14-09-2010 - 19:00
Published 14-09-2010 - 19:00
Last modified 14-09-2010 - 19:00
Back to Top