Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2008-4210

Overview

Vulnerability Score 4.6 4.6
CVE Id CVE-2008-4210
Last Modified 29 Oct 2012 11:16:53
Published 29 Sep 2008 01:17:29
Confidentiality Impact PARTIAL PARTIAL
Integrity Impact PARTIAL PARTIAL
Availability Impact PARTIAL PARTIAL
Access Vector LOCAL
Access Complexity LOW
Authentication NONE

CVE-2008-4210

Summary

fs/open.c in the Linux kernel before 2.6.22 does not properly strip setuid and setgid bits when there is a write to a file, which allows local users to gain the privileges of a different group, and obtain sensitive information or possibly have unspecified other impact, by creating an executable file in a setgid directory through the (1) truncate or (2) ftruncate function in conjunction with memory-mapped I/O.

Vulnerable Systems

Operating System

  • Linux Kernel 2.2.27

  • Linux Kernel 2.4.36

  • Linux Kernel 2.4.36.1

  • Linux Kernel 2.4.36.2

  • Linux Kernel 2.4.36.3

  • Linux Kernel 2.4.36.4

  • Linux Kernel 2.4.36.5

  • Linux Kernel 2.4.36.6

  • Linux Kernel 2.6

  • Linux Kernel 2.6.18

  • Linux Kernel 2.6.19.4

  • Linux Kernel 2.6.19.5

  • Linux Kernel 2.6.19.6

  • Linux Kernel 2.6.19.7

  • Linux Kernel 2.6.20.16

  • Linux Kernel 2.6.20.17

  • Linux Kernel 2.6.20.18

  • Linux Kernel 2.6.20.19

  • Linux Kernel 2.6.20.20

  • Linux Kernel 2.6.20.21

  • Linux Kernel 2.6.21.5

  • Linux Kernel 2.6.21.6

  • Linux Kernel 2.6.21.7


References

CONFIRM - https://bugzilla.redhat.com/show_bug.cgi?id=463661

XF - linux-kernel-open-privilege-escalation(45539)

UBUNTU - USN-679-1

BID - 31368

REDHAT - RHSA-2008:0973

REDHAT - RHSA-2008:0957

REDHAT - RHSA-2008:0787

MLIST - [oss-security] 20080924 Re: CVE request: kernel: open() call allows setgid bit when user is not in new file's group

MLIST - [oss-security] 20080924 CVE request: kernel: open() call allows setgid bit when user is not in new file's group

MANDRIVA - MDVSA-2008:220

CONFIRM - http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22

DEBIAN - DSA-1653

SECUNIA - 33280

SECUNIA - 33201

SECUNIA - 32918

SECUNIA - 32799

SECUNIA - 32759

SECUNIA - 32485

SECUNIA - 32237

REDHAT - RHSA-2008:0972

SUSE - SUSE-SA:2008:057

SUSE - SUSE-SA:2008:056

SUSE - SUSE-SR:2008:025

CONFIRM - http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22

CONFIRM - http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.26.y.git;a=commit;h=7b82dc0e64e93f430182f36b46b79fcee87d3532

CONFIRM - http://bugzilla.kernel.org/show_bug.cgi?id=8420

SECUNIA - 32356

SECUNIA - 32344

SUSE - SUSE-SA:2008:051

Related Patches

Novell SUSE 2008:5734 kernel security update for SLE 10 SP1 i586


Last Updated: 27 May 2016 10:49:34