CVE-2011-1920

Severity Score

3.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The make include files in NetBSD before 1.6.2, as used in pmake 1.111 and other products, allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_depend##### temporary file, related to (1) bsd.lib.mk and (2) bsd.prog.mk.

El "make" incluye ficheros en NetBSD anterior a v1.6.2 usados en pmake v1.111 y otros productos, permite a usuarios locales sobreescribir ficheros de su elección a través de un ataque de enlace simbólico sobre un archivo temporal /tmp/_depend#####, relacionado con (1) bsd.lib.mk y (2) bsd.prog.mk.

*Credits: N/A

CVSS Scores

NISTv2 3.3

Attack Vector

Local

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2011-05-09 CVE Reserved
2011-05-23 CVE Published
2023-03-08 EPSS Updated
2024-08-06 CVE Updated
2024-08-06 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-59: Improper Link Resolution Before File Access ('Link Following')

CAPEC

References (9)

URL	Tag	Source
http://www.securityfocus.com/bid/47878	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/67495	Vdb Entry

URL	Date	SRC
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=626673	2024-08-06
http://openwall.com/lists/oss-security/2011/05/16/2	2024-08-06
https://bugzilla.redhat.com/show_bug.cgi?id=705090	2024-08-06

URL	Date	SRC
http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.lib.mk.diff?r1=1.239&r2=1.240&f=h	2017-08-17
http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.prog.mk.diff?r1=1.192&r2=1.193&f=h	2017-08-17
http://openwall.com/lists/oss-security/2011/05/16/8	2017-08-17
https://bugzilla.redhat.com/show_bug.cgi?id=705100	2017-08-17

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Netbsd Search vendor "Netbsd"	Netbsd Search vendor "Netbsd" for product "Netbsd"	*	-	Affected	in	Ihji Search vendor "Ihji"	Pmake Search vendor "Ihji" for product "Pmake"	1.111 Search vendor "Ihji" for product "Pmake" and version "1.111"	-	Affected
Netbsd Search vendor "Netbsd"	Netbsd Search vendor "Netbsd" for product "Netbsd"	<= 1.6.1 Search vendor "Netbsd" for product "Netbsd" and version " <= 1.6.1"	-	Affected	in	Ihji Search vendor "Ihji"	Pmake Search vendor "Ihji" for product "Pmake"	1.111 Search vendor "Ihji" for product "Pmake" and version "1.111"	-	Affected
Netbsd Search vendor "Netbsd"	Netbsd Search vendor "Netbsd" for product "Netbsd"	1.0 Search vendor "Netbsd" for product "Netbsd" and version "1.0"	-	Affected	in	Ihji Search vendor "Ihji"	Pmake Search vendor "Ihji" for product "Pmake"	1.111 Search vendor "Ihji" for product "Pmake" and version "1.111"	-	Affected
Netbsd Search vendor "Netbsd"	Netbsd Search vendor "Netbsd" for product "Netbsd"	1.1 Search vendor "Netbsd" for product "Netbsd" and version "1.1"	-	Affected	in	Ihji Search vendor "Ihji"	Pmake Search vendor "Ihji" for product "Pmake"	1.111 Search vendor "Ihji" for product "Pmake" and version "1.111"	-	Affected
Netbsd Search vendor "Netbsd"	Netbsd Search vendor "Netbsd" for product "Netbsd"	1.2 Search vendor "Netbsd" for product "Netbsd" and version "1.2"	-	Affected	in	Ihji Search vendor "Ihji"	Pmake Search vendor "Ihji" for product "Pmake"	1.111 Search vendor "Ihji" for product "Pmake" and version "1.111"	-	Affected
Netbsd Search vendor "Netbsd"	Netbsd Search vendor "Netbsd" for product "Netbsd"	1.2.1 Search vendor "Netbsd" for product "Netbsd" and version "1.2.1"	-	Affected	in	Ihji Search vendor "Ihji"	Pmake Search vendor "Ihji" for product "Pmake"	1.111 Search vendor "Ihji" for product "Pmake" and version "1.111"	-	Affected
Netbsd Search vendor "Netbsd"	Netbsd Search vendor "Netbsd" for product "Netbsd"	1.3 Search vendor "Netbsd" for product "Netbsd" and version "1.3"	-	Affected	in	Ihji Search vendor "Ihji"	Pmake Search vendor "Ihji" for product "Pmake"	1.111 Search vendor "Ihji" for product "Pmake" and version "1.111"	-	Affected
Netbsd Search vendor "Netbsd"	Netbsd Search vendor "Netbsd" for product "Netbsd"	1.3.1 Search vendor "Netbsd" for product "Netbsd" and version "1.3.1"	-	Affected	in	Ihji Search vendor "Ihji"	Pmake Search vendor "Ihji" for product "Pmake"	1.111 Search vendor "Ihji" for product "Pmake" and version "1.111"	-	Affected
Netbsd Search vendor "Netbsd"	Netbsd Search vendor "Netbsd" for product "Netbsd"	1.3.2 Search vendor "Netbsd" for product "Netbsd" and version "1.3.2"	-	Affected	in	Ihji Search vendor "Ihji"	Pmake Search vendor "Ihji" for product "Pmake"	1.111 Search vendor "Ihji" for product "Pmake" and version "1.111"	-	Affected
Netbsd Search vendor "Netbsd"	Netbsd Search vendor "Netbsd" for product "Netbsd"	1.3.3 Search vendor "Netbsd" for product "Netbsd" and version "1.3.3"	-	Affected	in	Ihji Search vendor "Ihji"	Pmake Search vendor "Ihji" for product "Pmake"	1.111 Search vendor "Ihji" for product "Pmake" and version "1.111"	-	Affected
Netbsd Search vendor "Netbsd"	Netbsd Search vendor "Netbsd" for product "Netbsd"	1.4 Search vendor "Netbsd" for product "Netbsd" and version "1.4"	-	Affected	in	Ihji Search vendor "Ihji"	Pmake Search vendor "Ihji" for product "Pmake"	1.111 Search vendor "Ihji" for product "Pmake" and version "1.111"	-	Affected
Netbsd Search vendor "Netbsd"	Netbsd Search vendor "Netbsd" for product "Netbsd"	1.4.1 Search vendor "Netbsd" for product "Netbsd" and version "1.4.1"	-	Affected	in	Ihji Search vendor "Ihji"	Pmake Search vendor "Ihji" for product "Pmake"	1.111 Search vendor "Ihji" for product "Pmake" and version "1.111"	-	Affected
Netbsd Search vendor "Netbsd"	Netbsd Search vendor "Netbsd" for product "Netbsd"	1.4.2 Search vendor "Netbsd" for product "Netbsd" and version "1.4.2"	-	Affected	in	Ihji Search vendor "Ihji"	Pmake Search vendor "Ihji" for product "Pmake"	1.111 Search vendor "Ihji" for product "Pmake" and version "1.111"	-	Affected
Netbsd Search vendor "Netbsd"	Netbsd Search vendor "Netbsd" for product "Netbsd"	1.4.3 Search vendor "Netbsd" for product "Netbsd" and version "1.4.3"	-	Affected	in	Ihji Search vendor "Ihji"	Pmake Search vendor "Ihji" for product "Pmake"	1.111 Search vendor "Ihji" for product "Pmake" and version "1.111"	-	Affected
Netbsd Search vendor "Netbsd"	Netbsd Search vendor "Netbsd" for product "Netbsd"	1.5 Search vendor "Netbsd" for product "Netbsd" and version "1.5"	-	Affected	in	Ihji Search vendor "Ihji"	Pmake Search vendor "Ihji" for product "Pmake"	1.111 Search vendor "Ihji" for product "Pmake" and version "1.111"	-	Affected
Netbsd Search vendor "Netbsd"	Netbsd Search vendor "Netbsd" for product "Netbsd"	1.5.1 Search vendor "Netbsd" for product "Netbsd" and version "1.5.1"	-	Affected	in	Ihji Search vendor "Ihji"	Pmake Search vendor "Ihji" for product "Pmake"	1.111 Search vendor "Ihji" for product "Pmake" and version "1.111"	-	Affected
Netbsd Search vendor "Netbsd"	Netbsd Search vendor "Netbsd" for product "Netbsd"	1.5.2 Search vendor "Netbsd" for product "Netbsd" and version "1.5.2"	-	Affected	in	Ihji Search vendor "Ihji"	Pmake Search vendor "Ihji" for product "Pmake"	1.111 Search vendor "Ihji" for product "Pmake" and version "1.111"	-	Affected
Netbsd Search vendor "Netbsd"	Netbsd Search vendor "Netbsd" for product "Netbsd"	1.5.3 Search vendor "Netbsd" for product "Netbsd" and version "1.5.3"	-	Affected	in	Ihji Search vendor "Ihji"	Pmake Search vendor "Ihji" for product "Pmake"	1.111 Search vendor "Ihji" for product "Pmake" and version "1.111"	-	Affected
Netbsd Search vendor "Netbsd"	Netbsd Search vendor "Netbsd" for product "Netbsd"	1.6 Search vendor "Netbsd" for product "Netbsd" and version "1.6"	-	Affected	in	Ihji Search vendor "Ihji"	Pmake Search vendor "Ihji" for product "Pmake"	1.111 Search vendor "Ihji" for product "Pmake" and version "1.111"	-	Affected