Bug 242907 - CVE-2007-3103 init.d xfs script chown race condition vulnerability
CVE-2007-3103 init.d xfs script chown race condition vulnerability
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: xorg-x11 (Show other bugs)
4.0
All Linux
low Severity high
: ---
: ---
Assigned To: X/OpenGL Maintenance List
impact=important,source=idefense,repo...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2007-06-06 08:18 EDT by Marcel Holtmann
Modified: 2007-11-30 17:07 EST (History)
1 user (show)

See Also:
Fixed In Version: RHSA-2007-0519
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-07-12 06:29:20 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Marcel Holtmann 2007-06-06 08:18:45 EDT
From iDefense:

Local exploitation of a race condition vulnerability in init.d XFS (X Font
Server) script allows an attacker to elevate their privileges to root.

The XFS script is vulnerable to a race condition when it is started by init, or
by a system administrator. Specifically, it insecurely changes the file
permissions of a temporary file. This allows an attacker to make any file on the
system world writable.

Successful exploitation of this vulnerability results in an attacker gaining
root privileges on the affected system. However, in order to exploit this, it is
necessary for either the system to be rebooted, or for the administrator to
manually restart the XFS.
Comment 5 Mark J. Cox (Product Security) 2007-07-12 05:09:31 EDT
removing embargo
Comment 6 Red Hat Bugzilla 2007-07-12 06:29:20 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2007-0519.html

Note You need to log in before you can comment on or make changes to this bug.