REDHAT-BUG-458652

First published: Mon Aug 11 2008(Updated: )

Description of problem: Description of problem: /etc/rc.sysinit makes | find -L /var/lock /var/run ! -type d -exec rm -f {} \; at every start. It is common practice to have daemon-writable subdirs below /var/run or /var/lock (e.g. /var/run/openldap). When such a daemon is compromised, an attack could create a | /var/run/openldap/foo -> / symlink which wipes whole system at next startup. Version-Release number of selected component (if applicable): initscripts-8.76.2-1.x86_64 How reproducible: 100% Steps to Reproduce: 1. mkdir /var/run/foo 2. chown nobody:nobody /var/run/foo 3. runuser nobody -s /bin/sh 'ln -s / /var/run/foo/bar' 4. reboot Actual results: a lot of 'command not found' errors on startup Additional info: Kudos to Herbert Poetzl about discovering this vulnerability.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/references
• agent/type
• agent/first-publish-date
• agent/last-modified-date
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2008-3524
• agent/severity
• agent/description
• agent/event
• agent/trending
• agent/source
• agent/softwarecombine
• agent/tags
• agent/guess-ai
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• vendor/red hat
• canonical/initscripts