#VU47428 Permissions, Privileges, and Access Controls in Apache Ant - CVE-2020-11979

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU47428

#VU47428 Permissions, Privileges, and Access Controls in Apache Ant - CVE-2020-11979

Published: May 14, 2020 / Updated: October 8, 2020


Vulnerability identifier: #VU47428
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2020-11979
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability: No public exploit available
Vulnerable software:
Apache Ant
Software vendor:
Apache Foundation

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect patch for vulnerability #VU27924 (CVE-2020-1945). Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.


Remediation

Install updates from vendor's website.

External links