|
|
|
|
| |
Credit:
The information has been provided by iDefense.
The original article can be found at:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=557
|
| |
Vulnerable Systems:
* RedHat Enterprise Linux version 4
* Fedora Core 6
* (Other versions may also be affected)
The XFS script is vulnerable to a race condition when it is started by init, or by a system administrator. Specifically, it insecurely changes the file permissions of a temporary file. This allows an attacker to make any file on the system world writable.
Exploitation of this vulnerability results in an attacker gaining root privileges on the affected system.
However, in order to exploit this, it is necessary for either the system to be rebooted, or for the administrator to manually restart the XFS.
Vendor Status:
Red Hat has released errata updates for versions 4 and 5 of their Enterprise Linux software. More information is available at the URLs shown below.
https://rhn.redhat.com/errata/RHSA-2007-0519.html
https://rhn.redhat.com/errata/RHSA-2007-0520.html
CVE Information:
CVE-2007-3103
Disclosure Timeline:
* 06/05/2007 - Initial vendor notification
* 06/06/2007 - Initial vendor response
* 07/12/2007 - Coordinated public disclosure
|
|
|
|
|
