CVE-2008-0884

system-auth-ac is world-writable

Severity Score

6.9

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The Replace function in the capp-lspp-config script in the (1) lspp-eal4-config-ibm and (2) capp-lspp-eal4-config-hp packages before 0.65-2 in Red Hat Enterprise Linux (RHEL) 5 uses lstat instead of stat to determine the /etc/pam.d/system-auth file permissions, leading to a change to world-writable permissions for the /etc/pam.d/system-auth-ac file, which allows local users to gain privileges by modifying this file.

La función Replace en la secuencia de comandos capp-lspp-config de los paquetes (1) lspp-eal4-config-ibm y (2) capp-lspp-eal4-config-hp versiones anteriores 0.65-2 de Red Hat Enterprise Linux (RHEL) 5 utiliza lstat en vez de stat para determinar los permisos del fichero /etc/pam.d/system-auth, conduciendo al cambio de los permisos world-writable para el fichero /etc/pam.d/system-auth-ac, lo cual permite a usuarios locales conseguir privilegios modificando este fichero.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Medium

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2008-02-21 CVE Reserved
2008-04-04 CVE Published
2023-03-08 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-732: Incorrect Permission Assignment for Critical Resource

CAPEC

References (7)

URL	Tag	Source
http://secunia.com/advisories/29642	Broken Link
http://securitytracker.com/id?1019740	Third Party Advisory
http://www.securityfocus.com/bid/28557	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/41584	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://rhn.redhat.com/errata/RHSA-2008-0193.html	2023-02-13
https://bugzilla.redhat.com/show_bug.cgi?id=435442	2008-04-01
https://access.redhat.com/security/cve/CVE-2008-0884	2008-04-01

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Redhat Search vendor "Redhat"		Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"				5.0 Search vendor "Redhat" for product "Enterprise Linux" and version "5.0"		-		Affected