| Vulnerability Name: | CVE-2008-3524 (CCN-45402) | ||||||||
| Assigned: | 2008-08-11 | ||||||||
| Published: | 2008-08-11 | ||||||||
| Updated: | 2017-08-08 | ||||||||
| Summary: | rc.sysinit in initscripts before 8.76.3-1 on Fedora 9 and other Linux platforms allows local users to delete arbitrary files via a symlink attack on a file or directory under (1) /var/lock or (2) /var/run. | ||||||||
| CVSS v3 Severity: | 5.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
| ||||||||
| CVSS v2 Severity: | 4.7 Medium (CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C) 4.1 Medium (Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C/E:H/RL:OF/RC:C)
2.9 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:P/A:P/E:H/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-59 | ||||||||
| Vulnerability Consequences: | File Manipulation | ||||||||
| References: | Source: MITRE Type: CNA CVE-2008-3524 Source: CCN Type: initscripts Web page initscripts package page Source: SECUNIA Type: Vendor Advisory 32037 Source: SECUNIA Type: UNKNOWN 32710 Source: CONFIRM Type: UNKNOWN http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0318 Source: CCN Type: OSVDB ID: 48605 Fedora Linux initscripts /etc/rc.sysinit Symlink Arbitrary File Removal Source: CCN Type: OSVDB ID: 50298 rPath initscripts rc.sysinit Multiple Directory Symlink Arbitrary File Deletion Source: BID Type: UNKNOWN 31385 Source: CCN Type: BID-31385 initscripts Arbitrary File Deletion Vulnerability Source: CONFIRM Type: UNKNOWN https://bugzilla.redhat.com/show_bug.cgi?id=458504 Source: CCN Type: Red Hat Bugzilla Bug 458652 (CVE-2008-3524) CVE-2008-3524 initscripts: possible system files removal via malicious symlink in /var/{lock,run} Source: CONFIRM Type: UNKNOWN https://bugzilla.redhat.com/show_bug.cgi?id=458652 Source: XF Type: UNKNOWN initscripts-rcsysinit-symlink(45402) Source: XF Type: UNKNOWN initscripts-rcsysinit-symlink(45402) Source: CONFIRM Type: UNKNOWN https://issues.rpath.com/browse/RPL-2857 Source: FEDORA Type: UNKNOWN FEDORA-2008-7667 | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||