CVE-2008-4108 Tools/faqwiz/move-faqwiz.sh (aka the generic FAQ wizard moving tool) in Python 2.4.5 might allow local users to overwrite arbitrary files via a symlink attack on a tmp$RANDOM.tmp temporary file. NOTE:...
HighCVSS 7.2
EPSS 0.39%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Tools/faqwiz/move-faqwiz.sh (aka the generic FAQ wizard moving tool) in Python 2.4.5 might allow local users to overwrite arbitrary files via a symlink attack on a tmp$RANDOM.tmp temporary file. NOTE: there may not be common usage scenarios in which tmp$RANDOM.tmp is located in an untrusted directory.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Python Software Foundation python | = 2.4.5 | No fix listed |
| debian/python-defaults(Debian:11) | All versions | No fix listed |
| debian/python-defaults(Debian:11) | = 2.7.18-3 | No fix listed |
References
- bugs.debian.org
- [oss-security] 20080915 CVE Request (python) mailing-list
- [oss-security] 20080916 Re: CVE Request (python) mailing-list
- 4274 third-party-advisory
- 31184 vdb-entry
- 1020904 vdb-entry
- ADV-2008-2659 vdb-entry
- bugzilla.redhat.com
- python-movefaqwiz-symlink(45161) vdb-entry
- security-tracker.debian.org vendor-advisory