Vulnerability Details CVE-2009-3289
The g_file_copy function in glib 2.0 sets the permissions of a target file to the permissions of a symbolic link (777), which allows user-assisted local users to modify files of other users, as demonstrated by using Nautilus to modify the permissions of the user home directory.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 23.2%
CVSS Severity
CVSS v3 Score 7.8
CVSS v2 Score 4.4
References
- http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html
- http://secunia.com/advisories/39656
- http://www.openwall.com/lists/oss-security/2009/09/08/8
- http://www.vupen.com/english/advisories/2010/1001
- https://bugs.launchpad.net/ubuntu/+source/glib2.0/+bug/418135
- https://bugzilla.gnome.org/show_bug.cgi?id=593406
- http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.html
- http://secunia.com/advisories/39656
- http://www.openwall.com/lists/oss-security/2009/09/08/8
- http://www.vupen.com/english/advisories/2010/1001
- https://bugs.launchpad.net/ubuntu/+source/glib2.0/+bug/418135
- https://bugzilla.gnome.org/show_bug.cgi?id=593406
Products affected by CVE-2009-3289
-
cpe:2.3:a:gnome:glib:2.0
-
cpe:2.3:o:opensuse:opensuse:11.0
-
cpe:2.3:o:opensuse:opensuse:11.1
-
cpe:2.3:o:suse:suse_linux_enterprise_server:11