Vulnerability Details CVE-2009-4135
The distcheck rule in dist-check.mk in GNU coreutils 5.2.1 through 8.1 allows local users to gain privileges via a symlink attack on a file in a directory tree under /tmp.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 7.6%
CVSS Severity
CVSS v2 Score 4.4
References
- http://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=ae034822c535fa5
- http://marc.info/?l=oss-security&m=126030454503441&w=2
- http://secunia.com/advisories/37645
- http://secunia.com/advisories/37860
- http://secunia.com/advisories/62226
- http://www.mail-archive.com/bug-coreutils%40gnu.org/msg18779.html
- http://www.mail-archive.com/bug-coreutils%40gnu.org/msg18787.html
- http://www.openwall.com/lists/oss-security/2009/12/08/4
- http://www.osvdb.org/60853
- http://www.securityfocus.com/bid/37256
- http://www.ubuntu.com/usn/USN-2473-1
- http://www.vupen.com/english/advisories/2009/3453
- https://bugzilla.redhat.com/show_bug.cgi?id=545439
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54673
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00954.html
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00972.html
- http://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=ae034822c535fa5
- http://marc.info/?l=oss-security&m=126030454503441&w=2
- http://secunia.com/advisories/37645
- http://secunia.com/advisories/37860
- http://secunia.com/advisories/62226
- http://www.mail-archive.com/bug-coreutils%40gnu.org/msg18779.html
- http://www.mail-archive.com/bug-coreutils%40gnu.org/msg18787.html
- http://www.openwall.com/lists/oss-security/2009/12/08/4
- http://www.osvdb.org/60853
- http://www.securityfocus.com/bid/37256
- http://www.ubuntu.com/usn/USN-2473-1
- http://www.vupen.com/english/advisories/2009/3453
- https://bugzilla.redhat.com/show_bug.cgi?id=545439
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54673
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00954.html
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00972.html
Products affected by CVE-2009-4135
-
cpe:2.3:a:gnu:coreutils:5.2.1
-
cpe:2.3:a:gnu:coreutils:5.91
-
cpe:2.3:a:gnu:coreutils:5.92
-
cpe:2.3:a:gnu:coreutils:5.93
-
cpe:2.3:a:gnu:coreutils:5.94
-
cpe:2.3:a:gnu:coreutils:5.95
-
cpe:2.3:a:gnu:coreutils:5.96
-
cpe:2.3:a:gnu:coreutils:5.97
-
cpe:2.3:a:gnu:coreutils:6.10
-
cpe:2.3:a:gnu:coreutils:6.11
-
cpe:2.3:a:gnu:coreutils:6.12
-
cpe:2.3:a:gnu:coreutils:6.2
-
cpe:2.3:a:gnu:coreutils:6.3
-
cpe:2.3:a:gnu:coreutils:6.4
-
cpe:2.3:a:gnu:coreutils:6.5
-
cpe:2.3:a:gnu:coreutils:6.6
-
cpe:2.3:a:gnu:coreutils:6.7
-
cpe:2.3:a:gnu:coreutils:6.8
-
cpe:2.3:a:gnu:coreutils:6.9
-
cpe:2.3:a:gnu:coreutils:7.1
-
cpe:2.3:a:gnu:coreutils:7.2
-
cpe:2.3:a:gnu:coreutils:7.3
-
cpe:2.3:a:gnu:coreutils:7.4
-
cpe:2.3:a:gnu:coreutils:7.5
-
cpe:2.3:a:gnu:coreutils:7.6
-
cpe:2.3:a:gnu:coreutils:8.1
-
cpe:2.3:o:canonical:ubuntu_linux:10.04
-
cpe:2.3:o:canonical:ubuntu_linux:12.04
-
cpe:2.3:o:canonical:ubuntu_linux:14.04
-
cpe:2.3:o:fedoraproject:fedora:11
-
cpe:2.3:o:fedoraproject:fedora:12