caml-light up to 0.75 Installer /tmp mktemp temp file

Summaryinfo

A vulnerability was found in caml-light up to 0.75. It has been classified as critical. This affects the function mktemp of the file /tmp of the component Installer. The manipulation leads to temp file. This vulnerability is referenced as CVE-2011-4119. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in caml-light up to 0.75. It has been rated as critical. This issue affects the function mktemp of the file /tmp of the component Installer. The manipulation with an unknown input leads to a temp file vulnerability. Using CWE to declare the problem leads to CWE-377. Creating and using insecure temporary files can leave application and system data vulnerable to attack. Impacted is confidentiality, integrity, and availability.

The weakness was published 10/26/2021. It is possible to read the advisory at gnats.netbsd.org. The identification of this vulnerability is CVE-2011-4119 since 10/18/2011. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 56723 (FreeBSD : caml-light -- insecure use of temporary files (9dde9dac-08f4-11e1-af36-003067b2972c)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family FreeBSD Local Security Checks.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (56723). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• caml-light

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31
• 0.32
• 0.33
• 0.34
• 0.35
• 0.36
• 0.37
• 0.38
• 0.39
• 0.40
• 0.41
• 0.42
• 0.43
• 0.44
• 0.45
• 0.46
• 0.47
• 0.48
• 0.49
• 0.50
• 0.51
• 0.52
• 0.53
• 0.54
• 0.55
• 0.56
• 0.57
• 0.58
• 0.59
• 0.60
• 0.61
• 0.62
• 0.63
• 0.64
• 0.65
• 0.66
• 0.67
• 0.68
• 0.69
• 0.70
• 0.71
• 0.72
• 0.73
• 0.74
• 0.75

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion