PT-2009-6308 · Gnu+1 · Gnu Coreutils+1

Jan Lieskovsky · Published 2009-12-11 · Updated 2023-02-13 · CVE-2009-4135

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GNU coreutils versions 5.2.1 through 8.1

Description The issue allows local users to gain privileges via a symlink attack on a file in a directory tree under /tmp. This is related to the distcheck rule in dist-check.mk.

Recommendations For GNU coreutils versions 5.2.1 through 8.1, consider restricting access to the distcheck rule in dist-check.mk to minimize the risk of exploitation. As a temporary workaround, avoid using the distcheck rule until a patch is available.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2009-4135

USN-2473-1

Affected Products

Gnu Coreutils

Ubuntu

References · 27

• https://redhat.com/archives/fedora-package-announce/2009-December/msg00954.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2473-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9471 · Security Note
• https://ubuntu.com/security/CVE-2009-4135 · Vendor Advisory
• http://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=ae034822c535fa5 · Patch
• https://redhat.com/archives/fedora-package-announce/2009-December/msg00972.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4135 · Security Note
• https://ubuntu.com/security/CVE-2014-9471 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=545439 · Patch
• http://marc.info/?l=oss-security&m=126030454503441&w=2 · Patch
• https://osv.dev/vulnerability/USN-2473-1 · Vendor Advisory
• http://ubuntu.com/usn/USN-2473-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4135 · Security Note
• http://osvdb.org/60853 · Note
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=766147 · Note