Published: 09/02/2005 Updated: 11/10/2017

CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9

VMScore: 187

Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N

The lvmcreate_initrd script in the lvm package in Trustix Secure Linux 1.5 up to and including 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files.

Vulnerable Product	Search on Vulmon	Subscribe to Product
lvm logical volume management utilities 1.0.1
lvm logical volume management utilities 1.0.4
lvm logical volume management utilities 1.0.7
lvm logical volume management utilities 1.0.8
gentoo linux

Recently, Trustix Secure Linux discovered a vulnerability in a supplemental script of the lvm10 package The program “lvmcreate_initrd” created a temporary directory in an insecure way, which could allow a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program ...

Trustix developers discovered insecure temporary file creation in a supplemental script in the lvm10 package that didn't check for existing temporary directories, allowing local users to overwrite files via a symlink attack For the stable distribution (woody) this problem has been fixed in version 104-5woody2 For the unstable distribution (sid) ...

NVD-CWE-Other http://www.securityfocus.com/bid/11290 http://www.trustix.org/errata/2004/0050 http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=136308 http://rhn.redhat.com/errata/RHBA-2004-232.html https://exchange.xforce.ibmcloud.com/vulnerabilities/17583 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10632 https://usn.ubuntu.com/15-1/https://nvd.nist.gov

CVE-2004-0972

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect