CVE-2004-0107 The (1) post and (2) trigger scripts in sysstat 4.0.7 and earlier allow local users to overwrite arbitrary files via symlink attacks on temporary files, a different vulnerability than CVE-2004-0108.
MediumCVSS 4.6
EPSS 0.39%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The (1) post and (2) trigger scripts in sysstat 4.0.7 and earlier allow local users to overwrite arbitrary files via symlink attacks on temporary files, a different vulnerability than CVE-2004-0108.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat sysstat | = 4.0.7-3 | No fix listed |
| sgi propack | = 2.3 | No fix listed |
| sgi propack | = 2.4 | No fix listed |
| sysstat | = 4.0.7 | No fix listed |
| sysstat | = 4.1.1 | No fix listed |
| sysstat | = 4.1.2 | No fix listed |
| sysstat | = 4.1.3 | No fix listed |
| sysstat | = 4.1.4 | No fix listed |
| sysstat | = 4.1.5 | No fix listed |
| sysstat | = 4.1.6 | No fix listed |
| sysstat | = 4.1.7 | No fix listed |
| sysstat | = 5.0.1 | No fix listed |
| debian/sysstat(Debian:12) | < 5.0.2-1 | 5.0.2-1 |
| debian/sysstat(Debian:13) | < 5.0.2-1 | 5.0.2-1 |
| debian/sysstat(Debian:14) | < 5.0.2-1 | 5.0.2-1 |
References
- O-097 government-resource third-party-advisory
- 6884 vdb-entry
- RHSA-2004:053 patch vendor-advisory
- RHSA-2004:093 vendor-advisory
- 9838 patch vdb-entry vendor-advisory
- sysstat-post-trigger-symlink(15428) vdb-entry
- oval:org.mitre.oval:def:10737 signature vdb-entry
- oval:org.mitre.oval:def:849 signature vdb-entry
- oval:org.mitre.oval:def:862 signature vdb-entry
- Debian Security Tracker CVE-2004-0107 vendor-advisory