CVE-2008-5156 si_mkbootserver in systemimager-server 3.6.3 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/.inetd.conf or (2) /tmp/pxe.conf..tmp temporary file.

MediumCVSS 6.9 EPSS 0.36%

Published: 2008-11-18 17:00
Updated: 2026-06-17 01:59
Exploit status: No public exploit known

Description

si_mkbootserver in systemimager-server 3.6.3 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/.inetd.conf or (2) /tmp/pxe.conf..tmp temporary file.

Affected products

Product	Affected versions	Fixed in
dann frazier systemimager-server	= 3.6.3	No fix listed

References

[debian-devel] 20080813 Re: Possible mass bug filing: The possibility of attack with the help of symlinks in some Debian packages mailing-list
uvw.ru exploit
32370 vdb-entry

CVSS v2.0

6.9 Medium

AV:L/AC:M/Au:N/C:C/I:C/A:C

Access Vector: Local
Access Complexity: Medium
Authentication: None
Confidentiality: Complete
Integrity: Complete
Availability: Complete

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.36% (percentile 30.6)
CWE: CWE-59

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.