CVE-2013-2029: Medium severity red hat openstack for ibm power vulnerability
+++ This bug was initially created as a clone of Bug #958002 +++
+++ This bug was initially created as a clone of Bug #957481 +++
Warning: nagios-3.4.4-1.el6ost/nagios.upgradetov3.sh
Tempfile is created by using $$ should use mktemp instead.
tmp1=/tmp/nagioscfg.$$.tmp
--- Additional comment from Kurt Seifried on 2013-04-30 03:19:10 EDT ---
nagios.upgradetov3.sh is not in upstreams files, it's added by Red Hat and several other vendors. So splitting this bug again.
Other sources
nagios.upgradetov3.sh, as distributed by Red Hat and possibly others for Nagios Core 3.4.4, 3.5.1, and earlier, allows local users to overwrite arbitrary files via a symlink attack on a temporary nagioscfg file with a predictable name in /tmp/.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2029?
The severity of CVE-2013-2029 is classified as low.
How do I fix CVE-2013-2029?
To fix CVE-2013-2029, you should apply the recommended patch provided by Red Hat.
Which versions of Red Hat OpenStack are affected by CVE-2013-2029?
CVE-2013-2029 specifically affects Red Hat OpenStack version 3.0.
What type of vulnerability is CVE-2013-2029?
CVE-2013-2029 is related to insecure temporary file usage.
Is CVE-2013-2029 still a concern in current software versions?
CVE-2013-2029 is less of a concern in later versions of Red Hat OpenStack due to fixes being implemented.