CVE-2008-1078

Severity Score

7.2

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

expn in the am-utils and net-fs packages for Gentoo, rPath Linux, and other distributions, allows local users to overwrite arbitrary files via a symlink attack on the expn[PID] temporary file. NOTE: this is the same issue as CVE-2003-0308.1.

expn en los paquetes am-utils y net-fs para Gentoo, rPath Linux y otras distribuciones, permite a usuarios locales sobrescribir archivos arbitrarios mediante un ataque de tipo symlink en el archivo temporal expn[PID]. NOTA: este es el mismo problema de CVE-2003-0308.1.

*Credits: N/A

CVSS Scores

NISTv2 7.2

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2008-02-28 CVE Reserved
2008-02-29 CVE Published
2023-03-08 EPSS Updated
2024-08-07 CVE Updated
2024-08-07 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-59: Improper Link Resolution Before File Access ('Link Following')

CAPEC

References (11)

URL	Tag	Source
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0088	X_refsource_confirm
http://www.securityfocus.com/archive/1/488931/100/0/threaded	Mailing List
http://www.securityfocus.com/bid/28044	Vdb Entry
https://issues.rpath.com/browse/RPL-2255	X_refsource_confirm

URL	Date	SRC
http://bugs.gentoo.org/show_bug.cgi?id=210158	2024-08-07

URL	Date	SRC

URL	Date	SRC
http://secunia.com/advisories/29144	2023-11-07
http://secunia.com/advisories/29187	2023-11-07
http://secunia.com/advisories/29694	2023-11-07
http://secunia.com/advisories/33400	2023-11-07
http://www.gentoo.org/security/en/glsa/glsa-200804-09.xml	2023-11-07
https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00273.html	2023-11-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Gentoo Search vendor "Gentoo"		Linux Search vendor "Gentoo" for product "Linux"				*		-		Affected
Rpath Search vendor "Rpath"		Rpath Linux Search vendor "Rpath" for product "Rpath Linux"				*		-		Affected