CVE-2009-1215 - Vulnerability Details - OpenCVE

Race condition in GNU screen 4.0.3 allows local users to create or overwrite arbitrary files via a symlink attack on the /tmp/screen-exchange temporary file.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Local

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Gnu	Gnu Screen

Configuration 1 [-]

cpe:2.3:a:gnu:gnu_screen:4.0.3:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521123
http://savannah.gnu.org/bugs/?25296
http://www.openwall.com/lists/oss-security/2009/03/25/7
http://www.securityfocus.com/bid/34521
https://bugs.launchpad.net/ubuntu/+source/screen/+bug/315993
https://bugzilla.redhat.com/show_bug.cgi?id=492104
https://exchange.xforce.ibmcloud.com/vulnerabilities/49887
https://nvd.nist.gov/vuln/detail/CVE-2009-1215
https://www.cve.org/CVERecord?id=CVE-2009-1215

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2009-04-01T10:00:00

Updated: 2024-08-07T05:04:49.328Z

Reserved: 2009-03-31T00:00:00

Link: CVE-2009-1215

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2009-04-01T10:30:00.500

Modified: 2025-04-09T00:30:58.490

Link: CVE-2009-1215

Redhat

Severity :

Publid Date: 2009-01-11T00:00:00Z

Links: CVE-2009-1215 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2009-03-25T00:00:00", "descriptions": [{"lang": "en", "value": "Race condition in GNU screen 4.0.3 allows local users to create or overwrite arbitrary files via a symlink attack on the /tmp/screen-exchange temporary file."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-16T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=492104"}, {"name": "[oss-security] 20090325 CVE request -- zsh, XFree86-xfs/xorg-x11-xfs, screen", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2009/03/25/7"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugs.launchpad.net/ubuntu/+source/screen/+bug/315993"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521123"}, {"name": "screen-screenexchange-symlink(49887)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49887"}, {"name": "34521", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/34521"}, {"tags": ["x_refsource_MISC"], "url": "http://savannah.gnu.org/bugs/?25296"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2009-1215", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Race condition in GNU screen 4.0.3 allows local users to create or overwrite arbitrary files via a symlink attack on the /tmp/screen-exchange temporary file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://bugzilla.redhat.com/show_bug.cgi?id=492104", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=492104"}, {"name": "[oss-security] 20090325 CVE request -- zsh, XFree86-xfs/xorg-x11-xfs, screen", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2009/03/25/7"}, {"name": "https://bugs.launchpad.net/ubuntu/+source/screen/+bug/315993", "refsource": "CONFIRM", "url": "https://bugs.launchpad.net/ubuntu/+source/screen/+bug/315993"}, {"name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521123", "refsource": "CONFIRM", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521123"}, {"name": "screen-screenexchange-symlink(49887)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49887"}, {"name": "34521", "refsource": "BID", "url": "http://www.securityfocus.com/bid/34521"}, {"name": "http://savannah.gnu.org/bugs/?25296", "refsource": "MISC", "url": "http://savannah.gnu.org/bugs/?25296"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T05:04:49.328Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=492104"}, {"name": "[oss-security] 20090325 CVE request -- zsh, XFree86-xfs/xorg-x11-xfs, screen", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2009/03/25/7"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugs.launchpad.net/ubuntu/+source/screen/+bug/315993"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521123"}, {"name": "screen-screenexchange-symlink(49887)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49887"}, {"name": "34521", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/34521"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://savannah.gnu.org/bugs/?25296"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2009-1215", "datePublished": "2009-04-01T10:00:00", "dateReserved": "2009-03-31T00:00:00", "dateUpdated": "2024-08-07T05:04:49.328Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gnu:gnu_screen:4.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "49FAB4AC-93A3-4733-8DE3-0CD96D25D8FB", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Race condition in GNU screen 4.0.3 allows local users to create or overwrite arbitrary files via a symlink attack on the /tmp/screen-exchange temporary file."}, {"lang": "es", "value": "Condici\u00f3n de carrera en GNU screen v4.0.3, permite a usuarios locales crear y sobreescribir archivos de su elecci\u00f3n a trav\u00e9s de un ataque de enlace simb\u00f3lico al archivo temporal /tmp/screen-exchange."}], "id": "CVE-2009-1215", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 1.9, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2009-04-01T10:30:00.500", "references": [{"source": "cve@mitre.org", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521123"}, {"source": "cve@mitre.org", "url": "http://savannah.gnu.org/bugs/?25296"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2009/03/25/7"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/34521"}, {"source": "cve@mitre.org", "url": "https://bugs.launchpad.net/ubuntu/+source/screen/+bug/315993"}, {"source": "cve@mitre.org", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=492104"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49887"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521123"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://savannah.gnu.org/bugs/?25296"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2009/03/25/7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/34521"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugs.launchpad.net/ubuntu/+source/screen/+bug/315993"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=492104"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49887"}], "sourceIdentifier": "cve@mitre.org", "vendorComments": [{"comment": "Red Hat does not consider this to be a security issue. The checks implemented by screen to protect against race condition attacks on /tmp/screen-exchange file provide sufficient protection for this rarely-used buffer exchange feature. For more details, see https://bugzilla.redhat.com/show_bug.cgi?id=492104", "lastModified": "2009-04-02T00:00:00", "organization": "Red Hat"}], "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}