Bug 460628 (CVE-2008-4982)

The rkhuner package, as shipped within the Fedora releases is prone
to the symlink attack.

Affected file: /usr/bin/rkhunter

Relevant part of the code:

   43 if [ "$1" = "--debug" ]; then
   44         if [ -e "/tmp/rkhunter-debug" ]; then
   45                 if [ -f "/tmp/rkhunter-debug" -a ! -h "/tmp/rkhunter-debug" ]; then
   46                         rm -f /tmp/rkhunter-debug >/dev/null 2>&1
   47                 else
   48                         echo "Cannot use '--debug' option. /tmp/rkhunter-debug already exists, but it is not a file."
   49                         exit 1
   50                 fi
   51         fi
   52 
   53         DEBUG_OPT=1
   54 
   55         exec 1>/tmp/rkhunter-debug 2>&1
   56         set -x

Description:

A malicious user could precreate a symbolic link pointing to the file
'/tmp/rkhunter-debug', then run the rkhunter command to destroy / truncate
the target of the symlink to zero size.

References:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496366

Affected versions:

This issue affects all versions of the rkhunter package, as shipped within
the Fedora releases of 8 and 9 and the versions of the rkhunter package,
as shipped within the Extra Packages for Enterprise Linux (EPEL) project.