« Volver al listado

CVE-2008-4636

Estado: ModificadaAlta (7.2)—

yast2-backup 2.14.2 through 2.16.6 on SUSE Linux and Novell Linux allows local users to gain privileges via shell metacharacters in filenames used by the backup process.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Suse — Yast2-backup

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-4636",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-11-27T00:30:00.280",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00003.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/50284",
      "tags": [
        "Broken Link"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/32832",
      "tags": [
        "Broken Link",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/32464",
      "tags": [
        "Broken Link",
        "Patch",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46879",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00003.html",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/50284",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/32832",
      "tags": [
        "Broken Link",
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/32464",
      "tags": [
        "Broken Link",
        "Patch",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46879",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "yast2-backup 2.14.2 through 2.16.6 on SUSE Linux and Novell Linux allows local users to gain privileges via shell metacharacters in filenames used by the backup process."
    },
    {
      "lang": "es",
      "value": "yast2-backup de 2.14.2 a 2.16.6 en SUSE Linux y Novell Linux permite a usuarios locales obtener privilegios a través de metacaracteres de consola en nombres de archivos usados por el proceso de copia de respaldo."
    }
  ],
  "lastModified": "2026-06-16T22:58:13.017",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:novell:linux_desktop:9:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "5595E484-647C-4F85-94AB-5A4D55CD766B"
            },
            {
              "criteria": "cpe:2.3:o:novell:open_enterprise_server:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "C5C0C136-E406-4628-994A-682E8E729B50"
            },
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:10.2:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "24818450-FDA1-429A-AC17-68F44F584217"
            },
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:10.3:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "C35B68DF-1440-4587-8458-9C5F4D1E43F3"
            },
            {
              "criteria": "cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "1B42AB65-443B-4655-BAEA-4EB4A43D9509"
            },
            {
              "criteria": "cpe:2.3:o:suse:linux_enterprise_server:8:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "FA1E7EFF-1CCA-473B-8D5C-30D59C26DC70"
            },
            {
              "criteria": "cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "4CD2D897-E321-4CED-92E0-11A98B52053C"
            },
            {
              "criteria": "cpe:2.3:o:suse:suse_linux_enterprise_desktop:10:sp1:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "44320836-E2DE-4A1C-9820-AFFA087FF7FB"
            },
            {
              "criteria": "cpe:2.3:o:suse:suse_linux_enterprise_desktop:10:sp2:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "14DF1463-F23F-465F-8A35-D550A7438CB6"
            },
            {
              "criteria": "cpe:2.3:o:suse:suse_linux_enterprise_server:10:sp1:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "15E235E9-EC31-4F3F-80F7-981C720FF353"
            },
            {
              "criteria": "cpe:2.3:o:suse:suse_linux_enterprise_server:10:sp2:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "02E6A767-B9A5-4054-BE70-286E0A464248"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:suse:yast2-backup:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4668731B-1AF7-48A2-A0BA-9A056E85A559",
              "versionEndIncluding": "2.16.6",
              "versionStartIncluding": "2.14.2"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}