CVE-2008-2517

The sarab.sh script in SaraB before 0.2.4 places the dar program's encryption key on the command line, which allows local users to obtain sensitive information by listing the process.

Link	Resource
http://sarab.svn.sourceforge.net/viewvc/sarab/sarab/sarab.sh?r1=34&r2=36	Exploit
http://sarab.svn.sourceforge.net/viewvc/sarab/sarab/sarab.sh?view=log
http://sourceforge.net/project/shownotes.php?release_id=601603&group_id=91804
http://www.securityfocus.com/bid/29364
http://secunia.com/advisories/30394	Vendor Advisory
http://www.vupen.com/english/advisories/2008/1659/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/42621

Configuration 1

cpe:2.3:a:sarab:sarab:*:*:*:*:*:*:*:* cpe:2.3:a:sarab:sarab:0.2.2:*:*:*:*:*:*:*

---

Published : 2008-06-03 02:32

Updated : 2017-08-08 01:31

---

NVD link : CVE-2008-2517

Mitre link : CVE-2008-2517

No products.

CWE-200