CVE-2008-4986
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WIMS是影像服务和设备管理系统，主要是在新定义和先前定义的图像处理设备和服务管理的映射元素改写成标准管理语义和协议，包括但不限于的SNMP的CIM和Web服务管理。 WIMS 3.62版本允许本地用户借助一个对(a)/tmp/env#####,(b)/tmp/sed#####和(c)/tmp/referer-home.log临时文件的symlink攻击，重写任意文件。这些临时文件与(1)coqweb和(2)account.sh脚本有关。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2008-4986
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
wims 3.62 allows local users to overwrite arbitrary files via a symlink attack on (a) /tmp/env#####, (b) /tmp/sed#####, and (c) /tmp/referer-home.log temporary files, related to the (1) coqweb and (2) account.sh scripts.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WIMS 任意文件重写漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WIMS是影像服务和设备管理系统，主要是在新定义和先前定义的图像处理设备和服务管理的映射元素改写成标准管理语义和协议，包括但不限于的SNMP的CIM和Web服务管理。 WIMS 3.62版本允许本地用户借助一个对(a)/tmp/env#####,(b)/tmp/sed#####和(c)/tmp/referer-home.log临时文件的symlink攻击，重写任意文件。这些临时文件与(1)coqweb和(2)account.sh脚本有关。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2008-4986
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2008-4986
请登录查看更多情报信息。
Vendor Advisories for CVE-2008-4986 (2)
Mailing List Discussions for CVE-2008-4986 (1)
Other References for CVE-2008-4986 (2)
-
https://bugs.gentoo.org/show_bug.cgi?id=235770 x_refsource_CONFIRM
-
http://dev.gentoo.org/~rbu/security/debiantemp/wims x_refsource_CONFIRM
Same Patch Batch · n/a · 2008-11-06 · 28 CVEs total
| CVE-2008-4974 | netmrg 'rrdedit'任意文件重写漏洞 | |
| CVE-2008-4988 | lars_bahner xcal 'pscal'任意文件重写漏洞 | |
| CVE-2008-4987 | XASTIR 任意文件重写漏洞 | |
| CVE-2008-4985 | VDR 'vdrleaktest'任意文件重写漏洞 | |
| CVE-2008-4984 | freedesktop scratchbox2 任意文件重写漏洞 | |
| CVE-2008-4983 | scilab scilab-bin 任意文件重写漏洞 | |
| CVE-2008-4982 | rkhunter 任意文件重写漏洞 | |
| CVE-2008-4981 | Debian realtimebattle 'perl.robot'任意文件重写漏洞 | |
| CVE-2008-4980 | Debian rccp 'delqueueask'任意文件重写漏洞 | |
| CVE-2008-4979 | shrubbery rancid 'getipacctg'任意文件重写漏洞 | |
| CVE-2008-4978 | radiance 任意文件重写漏洞 | |
| CVE-2008-4977 | Postfix 'postfix_groups.pl'任意文件重写漏洞 | |
| CVE-2008-4976 | alan_woodland ogle-mmx 任意文件重写漏洞 | |
| CVE-2008-4975 | debian newsgate 'mkmailpost' 任意文件重写漏洞 | |
| CVE-2008-4991 | EC-CUBE SQL注入漏洞 | |
| CVE-2008-4973 | debian myspell 'i2myspell'任意文件重写漏洞 | |
| CVE-2008-4972 | steve_robbins mgt 'mailgo'任意文件重写漏洞 | |
| CVE-2008-4971 | mafft 'mafft-homologs'任意文件重写漏洞 | |
| CVE-2008-4970 | lustre-tests 'runiozone' 任意文件重写漏洞 | |
| CVE-2008-4969 | alastair_mckinstry ltp-network-test 任意文件重写漏洞 |
Showing top 20 of 28 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2008-4986
No comments yet