CVE-2008-4474 - Vulnerability Details - OpenCVE

freeradius-dialupadmin in freeradius 2.0.4 allows local users to overwrite arbitrary files via a symlink attack on temporary files in (1) backup_radacct, (2) clean_radacct, (3) monthly_tot_stats, (4) tot_stats, and (5) truncate_radacct.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Freeradius	Freeradius

Configuration 1 [-]

cpe:2.3:a:freeradius:freeradius:2.0.4:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496389
http://dev.gentoo.org/~rbu/security/debiantemp/freeradius-dialupadmin
http://lists.debian.org/debian-devel/2008/08/msg00271.html
http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00003.html
http://secunia.com/advisories/32170
http://secunia.com/advisories/33151
http://uvw.ru/report.lenny.txt
http://www.openwall.com/lists/oss-security/2008/10/30/2
http://www.securityfocus.com/bid/30901
https://bugs.gentoo.org/show_bug.cgi?id=235770
https://nvd.nist.gov/vuln/detail/CVE-2008-4474
https://www.cve.org/CVERecord?id=CVE-2008-4474

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2008-10-07T21:00:00

Updated: 2024-08-07T10:17:09.750Z

Reserved: 2008-10-07T00:00:00

Link: CVE-2008-4474

Vulnrichment

No data.

NVD

Status : Modified

Published: 2008-10-07T21:11:38.510

Modified: 2024-11-21T00:51:45.927

Link: CVE-2008-4474

Redhat

Severity : Moderate

Publid Date: 2008-08-24T00:00:00Z

Links: CVE-2008-4474 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-08-12T00:00:00", "descriptions": [{"lang": "en", "value": "freeradius-dialupadmin in freeradius 2.0.4 allows local users to overwrite arbitrary files via a symlink attack on temporary files in (1) backup_radacct, (2) clean_radacct, (3) monthly_tot_stats, (4) tot_stats, and (5) truncate_radacct."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2008-11-11T10:00:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "33151", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/33151"}, {"name": "32170", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/32170"}, {"name": "[oss-security] 20081030 CVE requests: tempfile issues for aview, mgetty, openoffice, crossfire", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2008/10/30/2"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugs.gentoo.org/show_bug.cgi?id=235770"}, {"tags": ["x_refsource_MISC"], "url": "http://uvw.ru/report.lenny.txt"}, {"name": "30901", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/30901"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496389"}, {"name": "SUSE-SR:2008:028", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00003.html"}, {"name": "[debian-devel] 20080811 Possible mass bug filing: The possibility of attack with the help of symlinks in some Debian packages", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://lists.debian.org/debian-devel/2008/08/msg00271.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://dev.gentoo.org/~rbu/security/debiantemp/freeradius-dialupadmin"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2008-4474", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "freeradius-dialupadmin in freeradius 2.0.4 allows local users to overwrite arbitrary files via a symlink attack on temporary files in (1) backup_radacct, (2) clean_radacct, (3) monthly_tot_stats, (4) tot_stats, and (5) truncate_radacct."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "33151", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/33151"}, {"name": "32170", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/32170"}, {"name": "[oss-security] 20081030 CVE requests: tempfile issues for aview, mgetty, openoffice, crossfire", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2008/10/30/2"}, {"name": "https://bugs.gentoo.org/show_bug.cgi?id=235770", "refsource": "CONFIRM", "url": "https://bugs.gentoo.org/show_bug.cgi?id=235770"}, {"name": "http://uvw.ru/report.lenny.txt", "refsource": "MISC", "url": "http://uvw.ru/report.lenny.txt"}, {"name": "30901", "refsource": "BID", "url": "http://www.securityfocus.com/bid/30901"}, {"name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496389", "refsource": "CONFIRM", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496389"}, {"name": "SUSE-SR:2008:028", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00003.html"}, {"name": "[debian-devel] 20080811 Possible mass bug filing: The possibility of attack with the help of symlinks in some Debian packages", "refsource": "MLIST", "url": "http://lists.debian.org/debian-devel/2008/08/msg00271.html"}, {"name": "http://dev.gentoo.org/~rbu/security/debiantemp/freeradius-dialupadmin", "refsource": "CONFIRM", "url": "http://dev.gentoo.org/~rbu/security/debiantemp/freeradius-dialupadmin"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T10:17:09.750Z"}, "title": "CVE Program Container", "references": [{"name": "33151", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/33151"}, {"name": "32170", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/32170"}, {"name": "[oss-security] 20081030 CVE requests: tempfile issues for aview, mgetty, openoffice, crossfire", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2008/10/30/2"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugs.gentoo.org/show_bug.cgi?id=235770"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://uvw.ru/report.lenny.txt"}, {"name": "30901", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/30901"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496389"}, {"name": "SUSE-SR:2008:028", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00003.html"}, {"name": "[debian-devel] 20080811 Possible mass bug filing: The possibility of attack with the help of symlinks in some Debian packages", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://lists.debian.org/debian-devel/2008/08/msg00271.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://dev.gentoo.org/~rbu/security/debiantemp/freeradius-dialupadmin"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2008-4474", "datePublished": "2008-10-07T21:00:00", "dateReserved": "2008-10-07T00:00:00", "dateUpdated": "2024-08-07T10:17:09.750Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:freeradius:freeradius:2.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "6A113B67-B9B6-421C-9EC9-E1FB462A4214", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "freeradius-dialupadmin in freeradius 2.0.4 allows local users to overwrite arbitrary files via a symlink attack on temporary files in (1) backup_radacct, (2) clean_radacct, (3) monthly_tot_stats, (4) tot_stats, and (5) truncate_radacct."}, {"lang": "es", "value": "freeradius-dialupadmin en freeradius 2.0.4 permite a los usuario locales sobrescribir arbitrariamente archivos a trav\u00e9s de un ataque de enlace simb\u00f3lico en un archivo temporal en (1) backup_radacct, (2) clean_radacct, (3) monthly_tot_stats, (4) tot_stats, y (5) truncate_radacct."}], "id": "CVE-2008-4474", "lastModified": "2024-11-21T00:51:45.927", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2008-10-07T21:11:38.510", "references": [{"source": "cve@mitre.org", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496389"}, {"source": "cve@mitre.org", "url": "http://dev.gentoo.org/~rbu/security/debiantemp/freeradius-dialupadmin"}, {"source": "cve@mitre.org", "url": "http://lists.debian.org/debian-devel/2008/08/msg00271.html"}, {"source": "cve@mitre.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00003.html"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/32170"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/33151"}, {"source": "cve@mitre.org", "url": "http://uvw.ru/report.lenny.txt"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2008/10/30/2"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/30901"}, {"source": "cve@mitre.org", "url": "https://bugs.gentoo.org/show_bug.cgi?id=235770"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496389"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://dev.gentoo.org/~rbu/security/debiantemp/freeradius-dialupadmin"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.debian.org/debian-devel/2008/08/msg00271.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00003.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/32170"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/33151"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://uvw.ru/report.lenny.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2008/10/30/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/30901"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugs.gentoo.org/show_bug.cgi?id=235770"}], "sourceIdentifier": "cve@mitre.org", "vendorComments": [{"comment": "Not vulnerable. This issue did not affect the versions of freeradius as shipped with Red Hat Enterprise Linux 3, 4, or 5.", "lastModified": "2009-02-06T02:00:36.217", "organization": "Red Hat"}], "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "nvd@nist.gov", "type": "Primary"}]}