CVE-2008-1570

UNKNOWN

Race condition in the create_lockpath function in policyd-weight 0

Published Mar 31, 2008

Modified 1 years ago

No fix available

Details

Race condition in the create_lockpath function in policyd-weight 0.1.14 beta-16 allows local users to modify or delete arbitrary files by creating the LOCKPATH directory, then modifying it after the symbolic link check occurs. NOTE: this is due to an incomplete fix for CVE-2008-1569.

References

ADVISORYhttp://secunia.com/advisories/29738 ADVISORYhttp://security.gentoo.org/glsa/glsa-200804-11.xml WEBhttp://www.osvdb.org/43888 WEBhttps://bugs.gentoo.org/show_bug.cgi?id=214403 WEBhttps://exchange.xforce.ibmcloud.com/vulnerabilities/41570 ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2008-1570

CVSS Analysis

CVSS v2.0

6.9

Exploitability

Access Vector

LocalAV:L

Access Complexity

MediumAC:M

Authentication

NoneAu:N

Impact

Confidentiality

CompleteC:C

Integrity

CompleteI:C

Availability

CompleteA:C

6.9/AV:L/AC:M/Au:N/C:C/I:C/A:C

Ecosystems

Timeline

PublishedMar 31, 2008

ModifiedAug 7, 2024