{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "mtx-changer.Adic-Scalar-24 in bacula-common 2.4.2 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/mtx.##### temporary file, probably a related issue to CVE-2005-2995."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2008-12-08T23:00:00Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "[debian-devel] 20080813 Re: Possible mass bug filing: The possibility of attack with the help of symlinks in some Debian packages", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://lists.debian.org/debian-devel/2008/08/msg00347.html"}, {"tags": ["x_refsource_MISC"], "url": "http://uvw.ru/report.sid.txt"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2008-5373", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "mtx-changer.Adic-Scalar-24 in bacula-common 2.4.2 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/mtx.##### temporary file, probably a related issue to CVE-2005-2995."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "[debian-devel] 20080813 Re: Possible mass bug filing: The possibility of attack with the help of symlinks in some Debian packages", "refsource": "MLIST", "url": "http://lists.debian.org/debian-devel/2008/08/msg00347.html"}, {"name": "http://uvw.ru/report.sid.txt", "refsource": "MISC", "url": "http://uvw.ru/report.sid.txt"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T10:49:12.623Z"}, "title": "CVE Program Container", "references": [{"name": "[debian-devel] 20080813 Re: Possible mass bug filing: The possibility of attack with the help of symlinks in some Debian packages", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://lists.debian.org/debian-devel/2008/08/msg00347.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://uvw.ru/report.sid.txt"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2008-5373", "datePublished": "2008-12-08T23:00:00Z", "dateReserved": "2008-12-08T00:00:00Z", "dateUpdated": "2024-09-16T19:21:06.365Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:bacula:bacula:2.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "5CF0341C-0496-46DB-9EE9-985622684EB6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "mtx-changer.Adic-Scalar-24 in bacula-common 2.4.2 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/mtx.##### temporary file, probably a related issue to CVE-2005-2995."}, {"lang": "es", "value": "mtx-changer.Adic-Scalar-24 in bacula-common v2.4.2, permite a usuarios locales sobrescribir ficheros de su elecci\u00f3n a trav\u00e9s de un enlace de ataque simb\u00f3lico sobre el fichero temporal /tmp/mtx.#####. Cuestion probablemente relacionada con el CVE-2005-2995."}], "id": "CVE-2008-5373", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 6.9, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 10.0, "obtainAllPrivilege": true, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2008-12-08T23:30:00.393", "references": [{"source": "cve@mitre.org", "tags": ["Mailing List", "Technical Description"], "url": "http://lists.debian.org/debian-devel/2008/08/msg00347.html"}, {"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "http://uvw.ru/report.sid.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Technical Description"], "url": "http://lists.debian.org/debian-devel/2008/08/msg00347.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "http://uvw.ru/report.sid.txt"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "bacula-common: Insecure temporary file use in autochangers (symlink attack)", "id": "475469", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=475469"}, "csaw": false, "cvss": {"cvss_base_score": "5.6", "cvss_scoring_vector": "AV:L/AC:H/Au:N/C:N/I:C/A:C", "status": "draft"}, "details": ["mtx-changer.Adic-Scalar-24 in bacula-common 2.4.2 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/mtx.##### temporary file, probably a related issue to CVE-2005-2995."], "name": "CVE-2008-5373", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "bacula", "product_name": "Red Hat Enterprise Linux 6"}], "public_date": "2008-08-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2008-5373\nhttps://nvd.nist.gov/vuln/detail/CVE-2008-5373"], "statement": "The Red Hat Security Response Team has rated this issue as having low security impact. This issue is not currently planned to be addressed in Red Hat Enterprise Linux 6. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.", "threat_severity": "Low"}