CVE-2008-2517 The sarab.sh script in SaraB before 0.2.4 places the dar program's encryption key on the command line, which allows local users to obtain sensitive information by listing the process.
LowCVSS 2.1
EPSS 0.27%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The sarab.sh script in SaraB before 0.2.4 places the dar program's encryption key on the command line, which allows local users to obtain sensitive information by listing the process.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sarab | <= 0.2.3 | No fix listed |
| sarab | = 0.2.2 | No fix listed |
References
- sarab.svn.sourceforge.net exploit
- sarab.svn.sourceforge.net
- 30394 third-party-advisory vendor-advisory
- sourceforge.net
- 29364 vdb-entry
- ADV-2008-1659 vdb-entry
- sarab-ciphers-information-disclosure(42621) vdb-entry