CVE-2010-3996 - festival_server in Centre for Speech Technology Research (CSTR) Festival, probably 2.0.95-beta and e

CVE-2010-3996

Summary

festival_server in Centre for Speech Technology Research (CSTR) Festival, probably 2.0.95-beta and earlier, places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.

References

Vulnerable Configurations

cpe:2.3:a:cstr:festival:1.4.1:*:*:*:*:*:*:*
cpe:2.3:a:cstr:festival:1.4.1:*:*:*:*:*:*:*
cpe:2.3:a:cstr:festival:1.4.2:*:*:*:*:*:*:*
cpe:2.3:a:cstr:festival:1.4.2:*:*:*:*:*:*:*
cpe:2.3:a:cstr:festival:1.4.3:*:*:*:*:*:*:*
cpe:2.3:a:cstr:festival:1.4.3:*:*:*:*:*:*:*
cpe:2.3:a:cstr:festival:1.95:*:*:*:*:*:*:*
cpe:2.3:a:cstr:festival:1.95:*:*:*:*:*:*:*
cpe:2.3:a:cstr:festival:1.96:*:*:*:*:*:*:*
cpe:2.3:a:cstr:festival:1.96:*:*:*:*:*:*:*
cpe:2.3:a:cstr:festival:*:beta:*:*:*:*:*:*
cpe:2.3:a:cstr:festival:*:beta:*:*:*:*:*:*

CVSS

Base:	6.9 (as of 14-01-2011 - 06:47)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:L/AC:M/Au:N/C:C/I:C/A:C

refmap via4

bid	44395
confirm	https://bugzilla.novell.com/show_bug.cgi?id=642507
mlist	[opensuse-updates] 20101022 openSUSE-SU-2010:0756-1 (moderate): festival security update
suse	SUSE-SR:2010:019 SUSE-SR:2010:020

Last major update

14-01-2011 - 06:47

Published

05-11-2010 - 17:00

Last modified

14-01-2011 - 06:47