PT-2008-4664 · Ibm+4 · Aix+4

Published 2008-10-21 · Updated 2018-10-11 · CVE-2008-3248

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Symantec Veritas File System (VxFS) versions prior to 5.0 MP3 on Solaris, Linux, and AIX Symantec Veritas File System (VxFS) on HP-UX

Description: The issue concerns the Quick I/O for Database feature in Symantec Veritas File System (VxFS), where the qiomkfile does not properly initialize filesystem blocks during file creation. This allows local users to access sensitive information by creating and then reading files.

Recommendations: For Symantec Veritas File System (VxFS) versions prior to 5.0 MP3 on Solaris, Linux, and AIX, update to version 5.0 MP3 or later. For Symantec Veritas File System (VxFS) on HP-UX, consider restricting access to the Quick I/O for Database feature until a patch is available. As a temporary workaround, consider disabling the Quick I/O for Database feature to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-3248

Affected Products

Aix

Hp-Ux

Linux

Solaris

Symantec Veritas File System

References · 11

• http://symantec.com/avcenter/security/Content/2008.10.20.html · Vendor Advisory
• http://seer.entsupport.symantec.com/docs/310872.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3248 · Security Note
• http://securityfocus.com/archive/1/497626/100/0/threaded · Note
• http://security-objectives.com/advisories/SECOBJADV-2008-04.txt · Note
• http://securityfocus.com/bid/31678 · Note
• http://secunia.com/advisories/32332 · Note
• http://security-objectives.com/advisories/SECOBJSADV-2008-04.txt · Note
• http://vupen.com/english/advisories/2008/2875 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46008 · Note
• http://securitytracker.com/id?1021074 · Note