CVE-2008-4580 : fence_manual, as used in fence 2.02.00-r1 and possibly cman, allows local users

fence_manual, as used in fence 2.02.00-r1 and possibly cman, allows local users to modify arbitrary files via a symlink attack on the fence_manual.fifo temporary file.

Published 2008-10-15 20:08:03

Updated 2023-02-13 02:19:32

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2008-4580

Gentoo » Fence » Version: 2.02.00 Update R1
cpe:2.3:a:gentoo:fence:2.02.00:r1:*:*:*:*:*:*
Matching versions
Gentoo » Cman » Version: 2.02.00 Update R1
cpe:2.3:a:gentoo:cman:2.02.00:r1:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2008-4580

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2008-4580

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2008-4580

CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Assigned by: nvd@nist.gov (Primary)

Vendor statements for CVE-2008-4580

Red Hat 2009-11-12

Manual fencing agent is documented to only be provided for testing purposes and should not be used in production environments. Therefore, there is no plan to fix this flaw in Red Hat Cluster Suite for Red Hat Enterprise Linux 4, and in Red Hat Enterprise Linux 5.

References for CVE-2008-4580