CVE

Id
8535  
CVE No.
CVE-2004-0107  
Status
Candidate  
Description
The (1) post and (2) trigger scripts in sysstat 4.0.7 and earlier allow local users to overwrite arbitrary files via symlink attacks on temporary files, a different vulnerability than CVE-2004-0108.  
Phase
Modified (20100819)  
Votes
ACCEPT(4) Armstrong, Baker, Cole, Wall | MODIFY(2) Cox, Frech | NOOP(1) Christey  
Comments
Frech> XF:sysstat-post-trigger-symlink(15428) | http://xforce.iss.net/xforce/xfdb/15428 | Cox> This issue is in the vendor packaging of sysstat, not sysstat itself, | and does not apply to a particular version of upstream | sysstat. Suggest "trigger scripts in various vendors packaging of | syssstat allows local users..." or "in the Red Hat packaging of sysstat" | Christey> CIAC:O-097 | URL:http://www.ciac.org/ciac/bulletins/o-097.shtml | XF:sysstat-post-trigger-symlink(15428) | URL:http://xforce.iss.net/xforce/xfdb/15428 | BID:9838 | URL:http://www.securityfocus.com/bid/9838 | Christey> FEDORA:FEDORA-2004-1372 | URL:https://bugzilla.fedora.us/show_bug.cgi?id=1372  

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
52602 8535 CVE-2004-0107 REDHAT:RHSA-2004:053  View
52603 8535 CVE-2004-0107 URL:http://www.redhat.com/support/errata/RHSA-2004-053.html  View
52604 8535 CVE-2004-0107 REDHAT:RHSA-2004:093  View
52605 8535 CVE-2004-0107 URL:http://www.redhat.com/support/errata/RHSA-2004-093.html  View
52606 8535 CVE-2004-0107 SGI:20040302-01-U  View
52607 8535 CVE-2004-0107 URL:ftp://patches.sgi.com/support/free/security/advisories/20040302-01-U.asc  View
52608 8535 CVE-2004-0107 CIAC:O-097  View
52609 8535 CVE-2004-0107 URL:http://www.ciac.org/ciac/bulletins/o-097.shtml  View
52610 8535 CVE-2004-0107 BID:9838  View
52611 8535 CVE-2004-0107 URL:http://www.securityfocus.com/bid/9838  View
52612 8535 CVE-2004-0107 OSVDB:6884  View
52613 8535 CVE-2004-0107 URL:http://www.osvdb.org/6884  View
52614 8535 CVE-2004-0107 OVAL:oval:org.mitre.oval:def:849  View
52615 8535 CVE-2004-0107 URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:849  View
52616 8535 CVE-2004-0107 OVAL:oval:org.mitre.oval:def:862  View
52617 8535 CVE-2004-0107 URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:862  View
52618 8535 CVE-2004-0107 OVAL:oval:org.mitre.oval:def:10737  View
52619 8535 CVE-2004-0107 URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10737  View
52620 8535 CVE-2004-0107 XF:sysstat-post-trigger-symlink(15428)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
62737 JVNDB-2004-000078 sysstat の isag コマンドにおける不適切な一時ファイルを作成される脆弱性 sysstat 同梱される isag コマンドにおいて、セキュリティ上不適切な方法で一時ファイルを作成するため、シンボリックリンク攻撃を受ける脆弱性が存在します。 CVE-2004-0108 8535 4.6 http://jvndb.jvn.jp/ja/contents/2004/JVNDB-2004-000078.html  View