CVE-2008-4108: High severity cpython vulnerability
Description of problem:
A security flaw was discovered in the Python generic FAQ wizard moving tool (move-faqwiz.sh).
Relevant part of the code:
28 cutnpad $1 2 suffix1 29 cutnpad $2 1 prefix2 30 cutnpad $2 2 suffix2 31 tmpfile=tmp$RANDOM.tmp 32 file1=faq$prefix1.$suffix1.htp 33 file2=faq$prefix2.$suffix2.htp
Description:
An attacker could in advance create a symbolic link pointing to tmpXXXXX.tmp (the output produced by $RANDOM is only 5 digits long), then run the Python generic FAQ wizard moving tool which would allow him to erase / truncate the target of the symbolic link to zero size.
References:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=498899
Other sources
Tools/faqwiz/move-faqwiz.sh (aka the generic FAQ wizard moving tool) in Python 2.4.5 might allow local users to overwrite arbitrary files via a symlink attack on a tmp$RANDOM.tmp temporary file. NOTE: there may not be common usage scenarios in which tmp$RANDOM.tmp is located in an untrusted directory.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-4108?
CVE-2008-4108 has been classified as a moderate severity vulnerability.
How do I fix CVE-2008-4108?
To fix CVE-2008-4108, it is recommended to upgrade Python to a version greater than 2.4.5.
What type of vulnerability is CVE-2008-4108?
CVE-2008-4108 is a security flaw found in the Python generic FAQ wizard moving tool.
Which software is affected by CVE-2008-4108?
CVE-2008-4108 affects Python version 2.4.5.
Is there a known exploit for CVE-2008-4108?
Yes, there are known exploits that leverage the vulnerabilities in the Python generic FAQ wizard.