CVE-2008-5147: Medium severity holloway docvert vulnerability

Published Nov 18, 2008

Updated

test-pipe-to-pyodconverter.org.sh in docvert 2.4 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/outer.odt temporary file.

Affected Software

1 affected component

Holloway Docvert=2.4

Event History

Nov 18, 2008

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

Who is exposed to this issue?

Systems running Docvert 2.4 are exposed when a local user can interact with the host and exploit the predictable /tmp/outer.odt temporary-file path.

What does an attacker need to exploit it?

The attacker needs local access and must create a symbolic link targeting /tmp/outer.odt so that the affected script writes to an arbitrary file.

What is the impact of successful exploitation?

A successful symlink attack can overwrite arbitrary files with the privileges of the affected Docvert process, potentially affecting confidentiality, integrity, and availability.

CVE-2008-5147: Medium severity holloway docvert vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?