Published: 29/09/2008 Updated: 08/08/2017

CVSS v2 Base Score: 6.9 | Impact Score: 10 | Exploitability Score: 3.4

VMScore: 695

Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C

The pserver_shutdown function in fence_egenera in cman 2.20080629 and 2.20080801 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/eglog temporary file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat cman 2.20080629
redhat cman 2.20080801

Multiple insecure temporary file handling vulnerabilities were discovered in Red Hat Cluster A local attacker could exploit these to overwrite arbitrary local files via symlinks (CVE-2008-4192, CVE-2008-4579, CVE-2008-4580, CVE-2008-6552) ...

Debian Bug report logs - #496410 The possibility of attack with the help of symlinks in some Debian packages Package: cman; Maintainer for cman is Debian HA Maintainers <debian-ha-maintainers@listsaliothdebianorg>; Source for cman is src:redhat-cluster (PTS, buildd, popcon) Reported by: "Dmitry E Oboukhov" <dimka@uvw ...

## # $Id$ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions Please see the Metasploit # web site for more information on licensing and terms of use # metasploitcom/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = GreatRanking include Ms ...

CWE-59 http://www.openwall.com/lists/oss-security/2008/09/18/3 http://www.openwall.com/lists/oss-security/2008/09/24/2 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496410 https://bugzilla.redhat.com/show_bug.cgi?id=460476 http://www.openwall.com/lists/oss-security/2008/10/30/2 https://bugs.gentoo.org/show_bug.cgi?id=235770 http://dev.gentoo.org/~rbu/security/debiantemp/cman http://www.securityfocus.com/bid/30898 http://secunia.com/advisories/32387 https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00666.html http://uvw.ru/report.lenny.txt http://secunia.com/advisories/32390 http://secunia.com/advisories/31887 http://www.ubuntu.com/usn/USN-875-1 http://www.redhat.com/support/errata/RHSA-2011-0266.html http://www.vupen.com/english/advisories/2011/0419 http://secunia.com/advisories/43362 https://exchange.xforce.ibmcloud.com/vulnerabilities/44845 https://usn.ubuntu.com/875-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/19295/

CVE-2008-4192

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect