NVD

Id
855  
Name
CVE-2008-0884  
Description
The Replace function in the capp-lspp-config script in the (1) lspp-eal4-config-ibm and (2) capp-lspp-eal4-config-hp packages before 0.65-2 in Red Hat Enterprise Linux (RHEL) 5 uses lstat instead of stat to determine the /etc/pam.d/system-auth file permissions, leading to a change to world-writable permissions for the /etc/pam.d/system-auth-ac file, which allows local users to gain privileges by modifying this file.  
Reject
 
CVSS Version
2  
CVSS Score
6.9  
Severity
Medium  
CVSS Base Score
6.9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-03  
Published
2008-04-03  
Modified Date
2008-09-05  
Seq
2008-0884  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
5177 855 CVE-2008-0884 RHSA-2008:0193  View
5178 855 CVE-2008-0884 1019740  View
5179 855 CVE-2008-0884 28557  View
5180 855 CVE-2008-0884 redhat-lsppeal4config-insecure-permissions(41584)  View
5181 855 CVE-2008-0884 https://bugzilla.redhat.com/show_bug.cgi?id=435442  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
45933 JVNDB-2008-001243 Red Hat Enterprise Linux の lspp-eal4-config-ibm パッケージなどに関する権限昇格の脆弱性 Red Hat Enterprise Linux の lspp-eal4-config-ibm パッケージおよび capp-lspp-eal4-config-hp パッケージは、stat コマンドが、/etc/pam.d/system-auth でファイルの権限指定しているにも関わらず、lstat システムコールを使用するため、/etc/pam.d/system-auth-ac ファイルを書き込み権限の変更に導く脆弱性が存在します。 CVE-2008-0884 30997 CVE-2008-0884 855 4.3 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-001243.html 2008-04-01 2008-04-18 View