CVE-2008-1570: Race Condition

Published Mar 31, 2008

Updated

Race condition in the createlockpath function in policyd-weight 0.1.14 beta-16 allows local users to modify or delete arbitrary files by creating the LOCKPATH directory, then modifying it after the symbolic link check occurs. NOTE: this is due to an incomplete fix for CVE-2008-1569.

Affected Software

2 affected componentsFixes available

debian/policyd-weight

0.1.15.2-120.1.15.2-12.1

policyd-weight policyd-weight=0.1.14_beta-14

Event History

Mar 31, 2008

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-1570?

CVE-2008-1570 is considered a moderate severity vulnerability due to the potential for local users to modify or delete arbitrary files.

How do I fix CVE-2008-1570?

To resolve CVE-2008-1570, upgrade to policyd-weight version 0.1.15.2-12 or later.

Who is affected by CVE-2008-1570?

CVE-2008-1570 affects users of policyd-weight version 0.1.14 beta-16 and earlier.

What is the impact of CVE-2008-1570?

The impact of CVE-2008-1570 allows local users to gain unauthorized access to modify or delete files.

What causes CVE-2008-1570?

CVE-2008-1570 is caused by a race condition in the create_lockpath function that allows modification of the LOCKPATH directory.