CVE-2015-8326 : The IPTables-Parse module before 1.6 for Perl allows local users to write to arb

The IPTables-Parse module before 1.6 for Perl allows local users to write to arbitrary files owned by the current user.

Published 2017-06-07 14:29:00

Updated 2017-06-14 16:15:58

Source Debian GNU/Linux

View at NVD, CVE.org

Products affected by CVE-2015-8326

Iptables-parse Project » Iptables-parse Module » Version: 0.6 For Perl
cpe:2.3:a:iptables-parse_project:iptables-parse_module:0.6:*:*:*:*:perl:*:*
Matching versions
Iptables-parse Project » Iptables-parse Module » Version: 0.5 For Perl
cpe:2.3:a:iptables-parse_project:iptables-parse_module:0.5:*:*:*:*:perl:*:*
Matching versions
Iptables-parse Project » Iptables-parse Module » Version: 1.3.1 For Perl
cpe:2.3:a:iptables-parse_project:iptables-parse_module:1.3.1:*:*:*:*:perl:*:*
Matching versions
Iptables-parse Project » Iptables-parse Module » Version: 1.3 For Perl
cpe:2.3:a:iptables-parse_project:iptables-parse_module:1.3:*:*:*:*:perl:*:*
Matching versions
Iptables-parse Project » Iptables-parse Module » Version: 0.8 For Perl
cpe:2.3:a:iptables-parse_project:iptables-parse_module:0.8:*:*:*:*:perl:*:*
Matching versions
Iptables-parse Project » Iptables-parse Module » Version: 1.0 For Perl
cpe:2.3:a:iptables-parse_project:iptables-parse_module:1.0:*:*:*:*:perl:*:*
Matching versions
Iptables-parse Project » Iptables-parse Module » Version: 1.4 For Perl
cpe:2.3:a:iptables-parse_project:iptables-parse_module:1.4:*:*:*:*:perl:*:*
Matching versions
Iptables-parse Project » Iptables-parse Module » Version: 1.6.1 For Perl
cpe:2.3:a:iptables-parse_project:iptables-parse_module:1.6.1:*:*:*:*:perl:*:*
Matching versions
Iptables-parse Project » Iptables-parse Module » Version: 0.9 For Perl
cpe:2.3:a:iptables-parse_project:iptables-parse_module:0.9:*:*:*:*:perl:*:*
Matching versions
Iptables-parse Project » Iptables-parse Module » Version: 0.7 For Perl
cpe:2.3:a:iptables-parse_project:iptables-parse_module:0.7:*:*:*:*:perl:*:*
Matching versions
Iptables-parse Project » Iptables-parse Module » Version: 1.1 For Perl
cpe:2.3:a:iptables-parse_project:iptables-parse_module:1.1:*:*:*:*:perl:*:*
Matching versions
Iptables-parse Project » Iptables-parse Module » Version: 1.5 For Perl
cpe:2.3:a:iptables-parse_project:iptables-parse_module:1.5:*:*:*:*:perl:*:*
Matching versions
Iptables-parse Project » Iptables-parse Module » Version: 1.6 For Perl
cpe:2.3:a:iptables-parse_project:iptables-parse_module:1.6:*:*:*:*:perl:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2015-8326

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-8326

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.6	LOW	AV:L/AC:L/Au:N/C:N/I:P/A:P	3.9	4.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: Partial
5.5	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2015-8326

CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-8326

https://bugzilla.redhat.com/show_bug.cgi?id=1267962

1267962 – (CVE-2015-8326) CVE-2015-8326 perl-IPTables-Parse: Use of predictable names for temporary files
Issue Tracking;Third Party Advisory
https://metacpan.org/source/MRASH/IPTables-Parse-1.6/Changes

Changes - metacpan.org
Release Notes;Third Party Advisory
https://github.com/mtrmac/IPTables-Parse/commit/b400b976d81140f6971132e94eb7657b5b0a2b87

Don't use predictable names for temporary files · mtrmac/IPTables-Parse@b400b97 · GitHub
Issue Tracking;Patch;Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/11/24/10

oss-security - Re: CVE Request: IPTables-Parse: Use of predictable names for temporary files
Mailing List;Patch;Third Party Advisory

Jump to

Vulnerability Details : CVE-2015-8326

Products affected by CVE-2015-8326

Exploit prediction scoring system (EPSS) score for CVE-2015-8326

CVSS scores for CVE-2015-8326

CWE ids for CVE-2015-8326

References for CVE-2015-8326