Vulnerability Name:

CVE-2007-3103 (CCN-35375)

Assigned:2007-07-11
Published:2007-07-11
Updated:2018-10-16
Summary:The init.d script for the X.Org X11 xfs font server on various Linux distributions might allow local users to change the permissions of arbitrary files via a symlink attack on the /tmp/.font-unix temporary file.
CVSS v3 Severity:8.1 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:6.2 Medium (CVSS v2 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C)
5.1 Medium (Temporal CVSS v2 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
6.2 Medium (CCN CVSS v2 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C)
5.1 Medium (CCN Temporal CVSS v2 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-59
Vulnerability Consequences:Gain Privileges
References:Source: CONFIRM
Type: UNKNOWN
http://bugs.gentoo.org/show_bug.cgi?id=185660

Source: CONFIRM
Type: UNKNOWN
http://bugzilla.redhat.com/242903

Source: MITRE
Type: CNA
CVE-2007-3103

Source: IDEFENSE
Type: Patch
20070712 Red Hat Enterprise Linux init.d XFS Script chown Race Condition Vulnerability

Source: OSVDB
Type: UNKNOWN
40945

Source: CCN
Type: RHSA-2007-0519
Moderate: xorg-x11 security update

Source: CCN
Type: RHSA-2007-0520
Moderate: xorg-x11-xfs security update

Source: SECUNIA
Type: Vendor Advisory
26056

Source: SECUNIA
Type: Vendor Advisory
26081

Source: SECUNIA
Type: Vendor Advisory
26282

Source: SECUNIA
Type: Vendor Advisory
27240

Source: SECUNIA
Type: Vendor Advisory
35674

Source: GENTOO
Type: UNKNOWN
GLSA-200710-11

Source: CCN
Type: SECTRACK ID: 1018375
X Font Server Temporary File Race Conditions Lets Local Users Gain Elevated Privileges

Source: CCN
Type: ASA-2007-324
xorg-x11 security update (RHSA-2007-0519)

Source: DEBIAN
Type: UNKNOWN
DSA-1342

Source: DEBIAN
Type: DSA-1342
xfs -- race condition

Source: CCN
Type: GLSA-200710-11
X Font Server: Multiple Vulnerabilities

Source: CCN
Type: OSVDB ID: 40945
X.Org X11 X Font Server (XFS) init.d Symlink Arbitrary File Permission Modification

Source: REDHAT
Type: UNKNOWN
RHSA-2007:0519

Source: REDHAT
Type: UNKNOWN
RHSA-2007:0520

Source: BUGTRAQ
Type: UNKNOWN
20070717 rPSA-2007-0141-1 xorg-x11 xorg-x11-fonts xorg-x11-tools xorg-x11-xfs

Source: BID
Type: UNKNOWN
24888

Source: CCN
Type: BID-24888
X.Org XFS Init Script Insecure Temporary File Creation Vulnerability

Source: SECTRACK
Type: UNKNOWN
1018375

Source: XF
Type: UNKNOWN
redhat-xfs-privilege-escalation(35375)

Source: XF
Type: UNKNOWN
redhat-xfs-privilege-escalation(35375)

Source: CONFIRM
Type: UNKNOWN
https://issues.rpath.com/browse/RPL-1485

Source: CCN
Type: iDefense Labs PUBLIC ADVISORY: 07.12.07
Red Hat Enterprise Linux init.d XFS Script chown Race Condition Vulnerability

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:10802

Source: EXPLOIT-DB
Type: UNKNOWN
5167

Source: FEDORA
Type: UNKNOWN
FEDORA-2009-3666

Source: FEDORA
Type: UNKNOWN
FEDORA-2009-3651

Vulnerable Configuration:Configuration 1:
  • cpe:/o:fedoraproject:fedora_core:6.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4.0:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4.0:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4.0:*:ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_desktop:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:*:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:4:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*

    • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

    • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*

    • Configuration RedHat 8:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client_workstation:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:server:*:*:*:*:*
  • AND
  • cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4.5.z::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4.5.z::es:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:18947
    P
    		DSA-1342-1 xfs
    2014-06-23
    oval:org.mitre.oval:def:21958
    P
    		ELSA-2007:0520: xorg-x11-xfs security update (Moderate)
    2014-05-26
    oval:org.mitre.oval:def:10802
    V
    		The init.d script for the X.Org X11 xfs font server on various Linux distributions might allow local users to change the permissions of arbitrary files via a symlink attack on the /tmp/.font-unix temporary file.
    2013-04-29
    oval:org.debian:def:1342
    V
    		race condition
    2007-07-30
    oval:com.redhat.rhsa:def:20070519
    P
    		RHSA-2007:0519: xorg-x11 security update (Moderate)
    2007-07-12
    oval:com.redhat.rhsa:def:20070520
    P
    		RHSA-2007:0520: xorg-x11-xfs security update (Moderate)
    2007-07-12
    BACK
    fedoraproject fedora core 6.0
    redhat enterprise linux 4.0
    redhat enterprise linux 4.0
    redhat enterprise linux 4.0
    redhat enterprise linux desktop 4.0
    redhat linux *
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 5
    redhat enterprise linux 5
    gentoo linux *
    redhat enterprise linux 5
    debian debian linux 4.0
    redhat enterprise linux 5
    redhat enterprise linux 4.5.z
    redhat enterprise linux 4.5.z