CVE-2011-4606 : Artsoft Entertainment Rocks'n'Diamonds (aka rocksndiamonds) 3.3.0.1 allows local users to overwrite arbitrary files via

Artsoft Entertainment Rocks'n'Diamonds (aka rocksndiamonds) 3.3.0.1 allows local users to overwrite arbitrary files via a symlink attack on .rocksndiamonds/cache/artworkinfo.cache under a user's home directory.

Published 2011-12-15 03:57:34

Updated 2011-12-15 16:32:18

Source Red Hat, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2011-4606

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2011-4606

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
3.6	LOW	AV:L/AC:L/Au:N/C:N/I:P/A:P	3.9	4.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: Partial

References for CVE-2011-4606

http://openwall.com/lists/oss-security/2011/12/12/2

oss-security - CVE request: rocksndiamonds world-writable working/config directory
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=651620

#651620 - ~/.rocksndiamonds/ is world-writable - Debian Bug report logs
http://openwall.com/lists/oss-security/2011/12/12/3

oss-security - Re: CVE request: rocksndiamonds world-writable working/config directory
https://bugzilla.redhat.com/show_bug.cgi?id=766805

766805 – (CVE-2011-4606) (CVE-2011-4606) rocksndiamonds: creates ~/.rocksndiamonds/ directory as world-writable
Patch

Products affected by CVE-2011-4606

Artsoft » Rocks'n'diamonds » Version: 3.3.0.1
cpe:2.3:a:artsoft:rocks\'n\'diamonds:3.3.0.1:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2011-4606

Exploit prediction scoring system (EPSS) score for CVE-2011-4606

CVSS scores for CVE-2011-4606

CWE ids for CVE-2011-4606

References for CVE-2011-4606

Products affected by CVE-2011-4606