CVE-2008-4908: Low severity crossfire vulnerability

Published Nov 4, 2008

Updated

maps/Info/combine.pl in CrossFire crossfire-maps 1.11.0 allows local users to overwrite arbitrary files via a symlink attack on a temporary file.

Affected Software

2 affected components

CrossFire CrossFire=1.11.0

Debian Debian Linux

Remediation

Patch Available

http://www.securityfocus.com/bid/30893

Event History

Nov 4, 2008

CVE Published

12:57 AM

Data Sourced

12:57 AM

DescriptionWeaknessAffected Software

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

Who is exposed to this issue?

Systems running CrossFire crossfire-maps 1.11.0 are exposed where untrusted local users can interact with the affected temporary-file handling. The attack is local; no remote access vector is indicated.

What does an attacker need to exploit it?

An attacker needs local access and must create a symlink targeting a file they want overwritten while the affected script uses its temporary file. The listed access complexity is medium and no authentication is required.

What is the impact of successful exploitation?

Successful exploitation can overwrite arbitrary files through the symlink attack. The provided vector indicates integrity and availability impacts, with no confidentiality impact.

What should be done to remediate the issue?

Apply the available patch for the affected CrossFire crossfire-maps 1.11.0 installation.

CVE-2008-4908: Low severity crossfire vulnerability

Affected Software

Remediation

Patch Available

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What should be done to remediate the issue?