National Cyber Awareness System

Vulnerability Summary for CVE-2007-2063

Overview

SSH Tectia Server for IBM z/OS before 5.4.0 uses insecure world-writable permissions for (1) the server pid file, which allows local users to cause arbitrary processes to be stopped, or (2) when _BPX_BATCH_UMASK is missing from the environment, creates HFS files with insecure permissions, which allows local users to read or modify these files and have other unknown impact.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: SECUNIA

Name: 24916

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/24916

External Source: XF

Name: ssh-tectia-pid-hfs-privilege-escalation(33699)

Hyperlink:http://xforce.iss.net/xforce/xfdb/33699

External Source: VUPEN

Name: ADV-2007-1414

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2007/1414

External Source: CONFIRM

Name: http://www.ssh.com/documents/33/SSH_Tectia_Server_5.4.0_zOS_releasenotes.txt

Hyperlink:http://www.ssh.com/documents/33/SSH_Tectia_Server_5.4.0_zOS_releasenotes.txt

External Source: BID

Name: 23508

Hyperlink:http://www.securityfocus.com/bid/23508

External Source: OSVDB

Name: 35014

Hyperlink:http://www.osvdb.org/35014

External Source: SECTRACK

Name: 1017913

Hyperlink:http://securitytracker.com/id?1017913

External Source: OSVDB

Name: 34998

Hyperlink:http://osvdb.org/34998