CVE-2008-0167 (GCVE-0-2008-0167)

Vulnerability from cvelistv5 – Published: 2008-05-18 14:00 – Updated: 2024-08-07 07:39
VLAI?
Summary
The write_array_file function in utils/include.pl in GForge 4.5.14 updates configuration files by truncating them to zero length and then writing new data, which might allow attackers to bypass intended access restrictions or have unspecified other impact in opportunistic circumstances.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://www.securityfocus.com/bid/29215 vdb-entryx_refsource_BID
http://secunia.com/advisories/30286 third-party-advisoryx_refsource_SECUNIA
http://security.debian.org/pool/updates/main/g/gf… x_refsource_CONFIRM
http://www.vupen.com/english/advisories/2008/1537… vdb-entryx_refsource_VUPEN
http://secunia.com/advisories/30088 third-party-advisoryx_refsource_SECUNIA
http://www.debian.org/security/2008/dsa-1577 vendor-advisoryx_refsource_DEBIAN
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T07:39:34.003Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "29215",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/29215"
          },
          {
            "name": "30286",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30286"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://security.debian.org/pool/updates/main/g/gforge/gforge_4.5.14-22etch8.diff.gz"
          },
          {
            "name": "ADV-2008-1537",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/1537/references"
          },
          {
            "name": "30088",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30088"
          },
          {
            "name": "DSA-1577",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2008/dsa-1577"
          },
          {
            "name": "gforge-unspecified-symlink(42456)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42456"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-05-14T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The write_array_file function in utils/include.pl in GForge 4.5.14 updates configuration files by truncating them to zero length and then writing new data, which might allow attackers to bypass intended access restrictions or have unspecified other impact in opportunistic circumstances."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-07T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "29215",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/29215"
        },
        {
          "name": "30286",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30286"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://security.debian.org/pool/updates/main/g/gforge/gforge_4.5.14-22etch8.diff.gz"
        },
        {
          "name": "ADV-2008-1537",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/1537/references"
        },
        {
          "name": "30088",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30088"
        },
        {
          "name": "DSA-1577",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2008/dsa-1577"
        },
        {
          "name": "gforge-unspecified-symlink(42456)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42456"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-0167",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The write_array_file function in utils/include.pl in GForge 4.5.14 updates configuration files by truncating them to zero length and then writing new data, which might allow attackers to bypass intended access restrictions or have unspecified other impact in opportunistic circumstances."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "29215",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/29215"
            },
            {
              "name": "30286",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/30286"
            },
            {
              "name": "http://security.debian.org/pool/updates/main/g/gforge/gforge_4.5.14-22etch8.diff.gz",
              "refsource": "CONFIRM",
              "url": "http://security.debian.org/pool/updates/main/g/gforge/gforge_4.5.14-22etch8.diff.gz"
            },
            {
              "name": "ADV-2008-1537",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/1537/references"
            },
            {
              "name": "30088",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/30088"
            },
            {
              "name": "DSA-1577",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2008/dsa-1577"
            },
            {
              "name": "gforge-unspecified-symlink(42456)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42456"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-0167",
    "datePublished": "2008-05-18T14:00:00",
    "dateReserved": "2008-01-09T00:00:00",
    "dateUpdated": "2024-08-07T07:39:34.003Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2008-0167\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2008-05-18T14:20:00.000\",\"lastModified\":\"2025-04-09T00:30:58.490\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The write_array_file function in utils/include.pl in GForge 4.5.14 updates configuration files by truncating them to zero length and then writing new data, which might allow attackers to bypass intended access restrictions or have unspecified other impact in opportunistic circumstances.\"},{\"lang\":\"es\",\"value\":\"La funci\u00f3n write_array_file en utils/include.pl de GForge 4.5.14 actualiza los archivos de configuraci\u00f3n trunc\u00e1ndolos a longitud cero y a continuaci\u00f3n escribe datos nuevos, lo que podr\u00eda permitir a atacantes evitar las restricciones de acceso planificadas o tener otros impactos no especificados en circunstancias oportunas.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":4.6,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.9,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":true,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-59\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0F92AB32-E7DE-43F4-B877-1F41FA162EC7\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:debian:debian_linux:4.0:*:alpha:*:*:*:*:*\",\"matchCriteriaId\":\"F5114DA3-FBB9-47C4-857B-3212404DAD4E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:debian:debian_linux:4.0:*:amd64:*:*:*:*:*\",\"matchCriteriaId\":\"4D5F5A52-285E-4E7E-83B8-508079DBCEAE\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:debian:debian_linux:4.0:*:arm:*:*:*:*:*\",\"matchCriteriaId\":\"674BE2D9-009B-46C5-A071-CB10368B8D48\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:debian:debian_linux:4.0:*:hppa:*:*:*:*:*\",\"matchCriteriaId\":\"703486E5-906B-4BDB-A046-28D4D73E3F03\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:debian:debian_linux:4.0:*:ia-32:*:*:*:*:*\",\"matchCriteriaId\":\"ABB5AC0D-2358-4C8E-99B5-2CE0A678F549\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:debian:debian_linux:4.0:*:ia-64:*:*:*:*:*\",\"matchCriteriaId\":\"38B37184-BA88-44F1-AC9E-8B60C2419111\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:debian:debian_linux:4.0:*:m68k:*:*:*:*:*\",\"matchCriteriaId\":\"0D8C9247-3E18-4DD9-AF5B-B2996C76443F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:debian:debian_linux:4.0:*:mips:*:*:*:*:*\",\"matchCriteriaId\":\"0EEA2CDD-7FCD-461E-90FC-CDB3C3992A32\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:debian:debian_linux:4.0:*:mipsel:*:*:*:*:*\",\"matchCriteriaId\":\"D7B877A8-5318-402E-8AE1-753E7419060F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:debian:debian_linux:4.0:*:powerpc:*:*:*:*:*\",\"matchCriteriaId\":\"A3938420-087D-4D92-A2F8-EAE54D9837EC\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:debian:debian_linux:4.0:*:s390:*:*:*:*:*\",\"matchCriteriaId\":\"4567FE5A-5061-4741-AA6D-4AB365579F8D\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:debian:debian_linux:4.0:*:sparc:*:*:*:*:*\",\"matchCriteriaId\":\"10F42CF8-FB98-4AFC-96C5-FD7D442B0FA3\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gforge:gforge:4.5.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"71D47383-4F0C-4B8F-AB82-0B5D3F0A8602\"}]}]}],\"references\":[{\"url\":\"http://secunia.com/advisories/30088\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/30286\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://security.debian.org/pool/updates/main/g/gforge/gforge_4.5.14-22etch8.diff.gz\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.debian.org/security/2008/dsa-1577\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.securityfocus.com/bid/29215\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2008/1537/references\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/42456\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/30088\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/30286\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://security.debian.org/pool/updates/main/g/gforge/gforge_4.5.14-22etch8.diff.gz\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2008/dsa-1577\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.securityfocus.com/bid/29215\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2008/1537/references\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/42456\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.