CVE-2009-1893: Medium severity redhat Enterprise Linux vulnerability
Robert Vogelgesang reported that dhcpd init script as used in dhcp packages in Red Hat Enterprise Linux 3 does not create temporary files safely inside configtest() function. Temporary file created by the script has predictable name (using script's process id), allowing local attacker to perform a symlink attack. When init script is called with configtest, restart or reload argument, arbitrary file may be overwritten by the output of 'dhcpd -t' (dhcpd.conf syntax check).
Other sources
The configtest function in the Red Hat dhcpd init script for DHCP 3.0.1 in Red Hat Enterprise Linux (RHEL) 3 allows local users to overwrite arbitrary files via a symlink attack on an unspecified temporary file, related to the "dhcpd -t" command.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1893?
CVE-2009-1893 is classified as a high-severity vulnerability due to the potential for local users to overwrite arbitrary files.
How do I fix CVE-2009-1893?
To fix CVE-2009-1893, users should apply the latest patches released by Red Hat for the affected versions of DHCP.
What versions are affected by CVE-2009-1893?
CVE-2009-1893 affects Red Hat Enterprise Linux 3.0 and ISC DHCP Server versions 3.0.1, including various release candidates.
What type of attack is associated with CVE-2009-1893?
CVE-2009-1893 is associated with a symlink attack that allows local users to manipulate temporary files.
Can CVE-2009-1893 be exploited remotely?
No, CVE-2009-1893 can only be exploited locally by authenticated users with access to the system.