CVE-2008-4192 The pserver_shutdown function in fence_egenera in cman 2.20080629 and 2.20080801 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/eglog temporary file.
MediumCVSS 6.9
EPSS 0.71%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The pserver_shutdown function in fence_egenera in cman 2.20080629 and 2.20080801 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/eglog temporary file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat cman | = 2.20080629 | No fix listed |
| redhat cman | = 2.20080801 | No fix listed |
References
- bugs.debian.org
- dev.gentoo.org
- 31887 third-party-advisory vendor-advisory
- 32387 third-party-advisory vendor-advisory
- 32390 third-party-advisory vendor-advisory
- 43362 third-party-advisory vendor-advisory
- uvw.ru
- [oss-security] 20080918 CVE Request (openswan, emacspeak, cman) mailing-list
- [oss-security] 20080923 Re: CVE Request (openswan, emacspeak, cman) mailing-list
- [oss-security] 20081030 CVE requests: tempfile issues for aview, mgetty, openoffice, crossfire mailing-list
- RHSA-2011:0266 vendor-advisory
- 30898 vdb-entry
- USN-875-1 vendor-advisory
- ADV-2011-0419 vdb-entry vendor-advisory
- bugs.gentoo.org
- bugzilla.redhat.com
- cman-fenceegenera-symlink(44845) vdb-entry
- FEDORA-2008-9042 vendor-advisory