CVE-2008-3524: Medium severity red hat fedora vulnerability
Description of problem:
Description of problem:
/etc/rc.sysinit makes
| find -L /var/lock /var/run ! -type d -exec rm -f {} \;
at every start. It is common practice to have daemon-writable subdirs below /var/run or /var/lock (e.g. /var/run/openldap). When such a daemon is compromised, an attack could create a
| /var/run/openldap/foo -> /
symlink which wipes whole system at next startup.
Version-Release number of selected component (if applicable):
initscripts-8.76.2-1.x8664
How reproducible:
100%
Steps to Reproduce: 1. mkdir /var/run/foo 2. chown nobody:nobody /var/run/foo 3. runuser nobody -s /bin/sh 'ln -s / /var/run/foo/bar' 4. reboot
Actual results:
a lot of 'command not found' errors on startup
Additional info:
Kudos to Herbert Poetzl about discovering this vulnerability.
Other sources
rc.sysinit in initscripts before 8.76.3-1 on Fedora 9 and other Linux platforms allows local users to delete arbitrary files via a symlink attack on a file or directory under (1) /var/lock or (2) /var/run.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-3524?
CVE-2008-3524 is considered a medium severity vulnerability due to its potential to allow denial of service attacks.
How do I fix CVE-2008-3524?
To fix CVE-2008-3524, apply updates to the Red Hat initscripts or upgrade your Fedora operating system to a patched version.
What systems are affected by CVE-2008-3524?
CVE-2008-3524 affects Red Hat initscripts version 8.76.3 and Fedora version 9.
What is the nature of the vulnerability in CVE-2008-3524?
The vulnerability in CVE-2008-3524 allows removal of files in /var/run or /var/lock, which can affect running daemons.
Is CVE-2008-3524 a remote or local vulnerability?
CVE-2008-3524 is a local vulnerability that requires access to the affected system to exploit.