CVE-2008-2517

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-06-03 · updated 2026-06-16
Weakness: CWE-200

Description

The sarab.sh script in SaraB before 0.2.4 places the dar program's encryption key on the command line, which allows local users to obtain sensitive information by listing the process.

Affected products

Sarab: through 0.2.3; 0.2.2

References

http://sarab.svn.sourceforge.net/viewvc/sarab/sarab/sarab.sh?r1=34&r2=36
http://sarab.svn.sourceforge.net/viewvc/sarab/sarab/sarab.sh?view=log
http://secunia.com/advisories/30394
http://sourceforge.net/project/shownotes.php?release_id=601603&group_id=91804
http://www.securityfocus.com/bid/29364
http://www.vupen.com/english/advisories/2008/1659/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/42621
http://sarab.svn.sourceforge.net/viewvc/sarab/sarab/sarab.sh?r1=34&r2=36
http://sarab.svn.sourceforge.net/viewvc/sarab/sarab/sarab.sh?view=log
http://secunia.com/advisories/30394
http://sourceforge.net/project/shownotes.php?release_id=601603&group_id=91804
http://www.securityfocus.com/bid/29364

Get alerted when CVE-2008-2517 or the next vulnerability affects your stack