PT-2008-1034 · Unknown · Policyd-Weight

Chris Howells · Published 2008-03-31 · Updated 2017-08-08 · CVE-2008-1570

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions policyd-weight version 0.1.14 beta-16

Description The issue is related to a race condition in the create lockpath function, allowing local users to modify or delete arbitrary files. This occurs by creating the LOCKPATH directory and then modifying it after the symbolic link check. The problem is due to an incomplete fix for a previous issue. Additionally, there are multiple vulnerabilities in the policyd-weight package that can lead to breaches of confidentiality, integrity, and availability of protected information, which can be exploited by a local attacker.

Recommendations For policyd-weight version 0.1.14 beta-16, consider disabling the create lockpath function as a temporary workaround until a patch is available. Restrict access to the LOCKPATH directory to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

Race Condition

Weakness Enumeration

CWE-59

CWE-362

Related Identifiers

BDU:2015-02883

CVE-2008-1570

DSA-1531-2

Affected Products

Policyd-Weight

References · 13

• https://bdu.fstec.ru/vul/2015-02883 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-1570 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-1570 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-1570 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1569 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2008-1570 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1570 · Security Note
• http://security.gentoo.org/glsa/glsa-200804-11.xml · Vendor Advisory
• http://secunia.com/advisories/29738 · Note
• https://bugs.gentoo.org/show_bug.cgi?id=214403 · Note
• http://debian.org/security/dsa-1531 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41570 · Note
• http://osvdb.org/43888 · Note