CVE-2007-5495: Medium severity redhat Enterprise Linux vulnerability
reported via secalert
By default, the sealert program writes diagnostic messages to the file /tmp/sealert.log. It does not check to ensure that this file does not already exist, or that it is not a symbolic link. An unprivileged local attacker can exploit this flaw to cause arbitrary files writable by other users to be overwritten when those users run sealert. The sealert program is run automatically, without user action, as part of the default RHEL 5 GNOME desktop session. It does not appear to be possible for the attacker to cause arbitrary data to be written to sealert.log, but the previous contents of the file are erased.'
Other sources
sealert in setroubleshoot 2.0.5 allows local users to overwrite arbitrary files via a symlink attack on the sealert.log temporary file.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-5495?
CVE-2007-5495 is considered a low severity vulnerability due to its exploitation requiring local access.
How do I fix CVE-2007-5495?
To fix CVE-2007-5495, ensure that the /tmp/sealert.log file does not exist or is not a symbolic link before running the sealert program.
What systems are affected by CVE-2007-5495?
CVE-2007-5495 affects systems using SELinux Setroubleshoot version 2.0.5.
Can CVE-2007-5495 be exploited remotely?
CVE-2007-5495 cannot be exploited remotely as it requires local access to the system.
Is CVE-2007-5495 a known issue in Red Hat products?
Yes, CVE-2007-5495 is a known issue in certain versions of Red Hat Enterprise Linux and SELinux Setroubleshoot.