Bug 470795 – CVE-2008-4993 xen: insecure temporary file use in qemu-dm.debug

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 470795 - (CVE-2008-4993) CVE-2008-4993 xen: insecure temporary file use in qemu-dm.debug

Summary:	CVE-2008-4993 xen: insecure temporary file use in qemu-dm.debug

Status:	CLOSED CURRENTRELEASE

Aliases:	CVE-2008-4993

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:	http://nvd.nist.gov/nvd.cfm?cvename=C...
Whiteboard:	source=cve,reported=20081107,public=2...
Keywords:	Security

Depends On:	470808 470809
Blocks:
	Show dependency tree / graph

Reported:	2008-11-10 06:04 EST by Tomas Hoger
Modified:	2016-03-04 07:02 EST (History)
CC List:	5 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2009-11-24 17:01:48 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2009:0003	normal	SHIPPED_LIVE	Moderate: xen security and bug fix update	2009-01-07 05:33:26 EST

Groups: None (edit)

Description Tomas Hoger 2008-11-10 06:04:17 EST

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-4993 to the following vulnerability:

qemu-dm.debug in Xen 3.2.1 allows local users to overwrite arbitrary
files via a symlink attack on the /tmp/args temporary file.

References:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496367
https://bugs.gentoo.org/show_bug.cgi?id=235805
http://dev.gentoo.org/~rbu/security/debiantemp/xen-utils-3.2-1

Comment 1 Tomas Hoger 2008-11-10 06:06:09 EST

This debug script is shipped in xen packages in Red Hat Enterprise Linux 5 and Fedora 8.  As of Fedora 9, most of the tools are moved to separate subpackage - xen-runtime - which does not ship qemu-dm.debug script.

Comment 2 Tomas Hoger 2008-11-10 06:08:37 EST

This seems to be quite dummy debug script, that is probably used by xen developers.  Can it possibly have any use on production deployments?

Comment 3 Daniel Berrange 2008-11-10 06:17:19 EST

I killed it off in Fedora 9 because it is a waste of time shipping it - anyone can trivially create something similar & more suitable to their needs. So I vote for killing it off everywhere else too.

Comment 7 Chris Lalancette 2009-11-24 17:01:48 EST

I do believe the errata was shipped for this a long time ago in all relevant packages, so I'm closing this tracking bug.

Chris Lalancette

Note You need to log in before you can comment on or make changes to this bug.