NVD

Id
4065  
Name
CVE-2008-4210  
Description
fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by creating an executable file in a setgid directory through the (1) truncate or (2) ftruncate function in conjunction with memory-mapped I/O.  
Reject
 
CVSS Version
2  
CVSS Score
4.6  
Severity
Medium  
CVSS Base Score
4.6  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-03  
Published
2008-09-29  
Modified Date
2012-10-29  
Seq
2008-4210  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
25824 4065 CVE-2008-4210 http://bugzilla.kernel.org/show_bug.cgi?id=8420  View
25825 4065 CVE-2008-4210 http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.26.y.git;a=commit;h=7b82dc0e64e93f430182f36b46b79fcee87d3532  View
25826 4065 CVE-2008-4210 http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22  View
25827 4065 CVE-2008-4210 SUSE-SA:2008:051  View
25828 4065 CVE-2008-4210 SUSE-SR:2008:025  View
25829 4065 CVE-2008-4210 SUSE-SA:2008:056  View
25830 4065 CVE-2008-4210 SUSE-SA:2008:057  View
25831 4065 CVE-2008-4210 oval:org.mitre.oval:def:6386  View
25832 4065 CVE-2008-4210 oval:org.mitre.oval:def:9511  View
25833 4065 CVE-2008-4210 RHSA-2008:0972  View
25834 4065 CVE-2008-4210 DSA-1653  View
25835 4065 CVE-2008-4210 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22  View
25836 4065 CVE-2008-4210 MDVSA-2008:220  View
25837 4065 CVE-2008-4210 [oss-security] 20080924 CVE request: kernel: open() call allows setgid bit when user is not in new file"s group  View
25838 4065 CVE-2008-4210 [oss-security] 20080924 Re: CVE request: kernel: open() call allows setgid bit when user is not in new file"s group  View
25839 4065 CVE-2008-4210 RHSA-2008:0787  View
25840 4065 CVE-2008-4210 RHSA-2008:0957  View
25841 4065 CVE-2008-4210 RHSA-2008:0973  View
25842 4065 CVE-2008-4210 31368  View
25843 4065 CVE-2008-4210 USN-679-1  View
25844 4065 CVE-2008-4210 linux-kernel-open-privilege-escalation(45539)  View
25845 4065 CVE-2008-4210 https://bugzilla.redhat.com/show_bug.cgi?id=463661  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
46615 JVNDB-2008-001925 Linux Kernel の fs/open.c における権限昇格の脆弱性 Linux Kernel の fs/open.c には、ファイルへの書き込みがある場合に、setuid および setgid ビットの除去処理に不備があるため、異なるグループの権限を取得される脆弱性が存在します。 CVE-2008-4210 34323 CVE-2008-4210 4065 4.6 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-001925.html 2008-09-29 2009-03-31 View