CVE-2014-3431 Misconfiguration in n/a
Local attackers can bypass file restrictions and read or modify data due to world-writable temporary file permissions in Symantec PGP Desktop on OS X.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-3431?
CVE-2014-3431 is a medium-severity vulnerability in n/a, published on 21 Jun 2014. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Symantec PGP Desktop 10.x, and Encryption Desktop Professional 10.3.x before 10.3.2 MP2, on OS X uses world-writable permissions for temporary files, which allows local users to bypass intended restrictions on file reading, modification, creation, and permission changes via unspecified vectors.
Weakness: CWE-264
Which versions are affected by CVE-2014-3431?
It affects 2 products.
Products include Symantec Encryption Desktop, Symantec Pgp Desktop.
How do I fix CVE-2014-3431?
No fix has been published for CVE-2014-3431 yet. Limit exposure of the affected software until one is available.
Is CVE-2014-3431 being exploited?
There is no known exploitation of CVE-2014-3431 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-c97m-p245-x627.