Published: 09/12/2008 Updated: 11/10/2018

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

VMScore: 725

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

/bin/login in shadow 4.0.18.1 in Debian GNU/Linux, and probably other Linux distributions, allows local users in the utmp group to overwrite arbitrary files via a symlink attack on a temporary file referenced in a line (aka ut_line) field in a utmp entry.

Vulnerable Product	Search on Vulmon	Subscribe to Product
debian shadow 4.0.18.1

Debian Bug report logs - #505271 symlink attack in login leading to arbitrary file ownership Package: login; Maintainer for login is Shadow package maintainers <pkg-shadow-devel@listsaliothdebianorg>; Source for login is src:shadow (PTS, buildd, popcon) Reported by: Paul Szabo <psz@mathsusydeduau> Date: Sun, 9 ...

Paul Szabo discovered a race condition in login While setting up tty permissions, login did not correctly handle symlinks If a local attacker were able to gain control of the system utmp file, they could cause login to change the ownership and permissions on arbitrary files, leading to a root privilege escalation ...

Paul Szabo discovered that login, the system login tool, did not correctly handle symlinks while setting up tty permissions If a local attacker were able to gain control of the system utmp file, they could cause login to change the ownership and permissions on arbitrary files, leading to a root privilege escalation For the stable distribution (et ...

#!/bin/bash - echo ' #include <stringh> #include <stdlibh> #include <unistdh> #include <utmph> #include <sys/typesh> #include <stdioh> int main(int argc, char *argv[]) { struct utmp entry; int i; entryut_type=LOGIN_PROCESS; strcpy(entryut_line,"/tmp/x"); entryut_time=0; strcp ...

CWE-59 http://bugs.debian.org/332198 http://bugs.debian.org/505071 http://bugs.debian.org/505271 http://www.securityfocus.com/bid/32552 http://www.ubuntu.com/usn/usn-695-1 http://securityreason.com/securityalert/4695 http://security.gentoo.org/glsa/glsa-200903-24.xml http://www.mandriva.com/security/advisories?name=MDVSA-2009:062 http://osvdb.org/52200 https://exchange.xforce.ibmcloud.com/vulnerabilities/47037 https://www.exploit-db.com/exploits/7313 http://www.securityfocus.com/archive/1/498769/100/0/threaded https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505271 https://usn.ubuntu.com/695-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/7313/

CVE-2008-5394

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect