Directory Traversal Vulnerability in Psensor
Summary
CVE-2014-10073: The create_response function in server/server.c in Psensor before 1.1.4 allows Directory Traversal because it lacks a check for whether a file is under the webserver directory. Affects psensor versions < 1.1.5-1. Fixed in 1.1.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Psensor is a package used for monitoring hardware temperatures in Linux systems. It provides a graphical interface to display real-time temperature readings. The vulnerability in Psensor allows for directory traversal, which means an attacker can access files outside of the webserver directory.
Vulnerability Detail
The create_response function in server/server.c in Psensor before 1.1.4 does not properly check if a file is under the webserver directory, leading to a directory traversal vulnerability. This vulnerability can be exploited by an attacker to access sensitive files on the system. The impact of this vulnerability can range from unauthorized access to confidential information to potential remote code execution.
How To Fix
Minimum fixed version
1.1.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade psensorTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not possible, a temporary workaround is to restrict access to the Psensor webserver directory. This can be done by modifying the webserver configuration to only allow access to necessary files and directories.
Conclusion
The directory traversal vulnerability in Psensor can lead to unauthorized access to sensitive files and potential remote code execution. It is crucial to update Psensor to the latest version to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for psensor →
FAQ
Psensor is a package used for monitoring hardware temperatures in Linux systems. It provides a graphical interface to display real-time temperature readings.
Directory traversal is a vulnerability that allows an attacker to access files outside of the intended directory. In this case, it allows access to files outside of the Psensor webserver directory.
With directory traversal, an attacker can potentially access sensitive files on the system, such as configuration files, user data, or even execute arbitrary code if the webserver has appropriate permissions.
To fix the vulnerability, update Psensor to version 1.1.5-1 or later. This update includes a fix for the directory traversal issue.
Yes, if an immediate update is not possible, you can restrict access to the Psensor webserver directory by modifying the webserver configuration.
Related vulnerabilities
Recent vulnerabilities recorded for psensor.
