Unscored severity · published May 23, 2011
CVE-2011-1920
The make include files in NetBSD before 1.6.2, as used in pmake 1.111 and other products, allow local users to overwrite arbitrary files via a symlink attack on a…
–
CVSS
0.4%
EPSS
No
On KEV
Description
The make include files in NetBSD before 1.6.2, as used in pmake 1.111 and other products, allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_depend##### temporary file, related to (1) bsd.lib.mk and (2) bsd.prog.mk.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
Netbsd · Netbsd
through 1.6.1; 1.0; 1.1; 1.2; 1.2.1; 1.3; +12 more · source: NVD
PM
Pmake · Ihji
1.111 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1920
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1920
Exploit
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=626673
Patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.lib.mk.diff?r1=1.239&r2=1.240&f=h
Patch
http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.prog.mk.diff?r1=1.192&r2=1.193&f=h
Exploit
http://openwall.com/lists/oss-security/2011/05/16/2
Patch
http://openwall.com/lists/oss-security/2011/05/16/8
www.securityfocus.com
http://www.securityfocus.com/bid/47878