REDHAT-BUG-288221
First published: Wed Sep 12 2007(Updated: )
reported via secalert By default, the sealert program writes diagnostic messages to the file /tmp/sealert.log. It does not check to ensure that this file does not already exist, or that it is not a symbolic link. An unprivileged local attacker can exploit this flaw to cause arbitrary files writable by other users to be overwritten when those users run sealert. The sealert program is run automatically, without user action, as part of the default RHEL 5 GNOME desktop session. It does not appear to be possible for the attacker to cause arbitrary data to be written to sealert.log, but the previous contents of the file are erased.'
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat sealert |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-288221?
The severity of REDHAT-BUG-288221 is considered moderate due to the potential for local attackers to exploit it.
How do I fix REDHAT-BUG-288221?
To fix REDHAT-BUG-288221, ensure that the /tmp/sealert.log file does not exist before running the sealert program.
What kind of attack can be executed using REDHAT-BUG-288221?
An unprivileged local attacker can exploit REDHAT-BUG-288221 to overwrite arbitrary files on the system.
Which software is affected by REDHAT-BUG-288221?
The affected software for REDHAT-BUG-288221 is the Red Hat sealert program.
What is the impact of exploiting REDHAT-BUG-288221?
Exploiting REDHAT-BUG-288221 can lead to unauthorized file overwriting, potentially resulting in data loss or system compromise.
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2007-5495
- agent/severity
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/red hat sealert