Info

Disclosure

Mar 27, 2010

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Apr 07, 2010

Description

Classification

Location: Local Access Required
Attack Type: Race Condition
Impact: Loss of Integrity
Solution: Upgrade
Exploit: Exploit Public
Disclosure: Vendor Verified, Uncoordinated Disclosure

Solution

Upgrade to version 2.2.4 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Unknown or Incomplete

References

Security Tracker: 1023891
CVE ID: 2010-1160 (see also: NVD)
Secunia Advisory ID: 39444 39618 39984
Related OSVDB ID: 63873
Other Advisory URL: http://drosenbe.blogspot.com/2010/03/nano-as-root.html
http://www.openwall.com/lists/oss-security/2010/04/14/4
Mail List Post: http://lists.gnu.org/archive/html/nano-devel/2010-04/msg00000.html
http://marc.info/?l=oss-security&m=127127295215585&w=2
http://seclists.org/bugtraq/2010/Mar/233
Vendor Specific News/Changelog Entry: http://svn.savannah.gnu.org/viewvc/trunk/nano/ChangeLog?revision=4503&root=nano&view=markup
Vendor Specific Advisory URL: http://www.gentoo.org/security/en/glsa/glsa-201006-08.xml

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/63872