CVE-2007-2654
Summary
| CVE | CVE-2007-2654 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2007-05-14 21:19:00 UTC |
| Updated | 2008-11-13 05:00:00 UTC |
| Description | xfs_fsr in xfsdump creates a .fsr temporary directory with insecure permissions, which allows local users to read or overwrite arbitrary files on xfs filesystems. |
Risk And Classification
Problem Types: CWE-362
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Suse | Opensuse | 10.2 | All | All | All |
| Operating System | Suse | Opensuse | 10.2 | All | All | All |
| Operating System | Suse | Suse Linux | 10 | All | enterprise_desktop | All |
| Operating System | Suse | Suse Linux | 10 | All | enterprise_server | All |
| Operating System | Suse | Suse Linux | 10.0 | All | oss | All |
| Operating System | Suse | Suse Linux | 10.1 | All | personal | All |
| Operating System | Suse | Suse Linux | 10.1 | All | professional | All |
| Operating System | Suse | Suse Linux | 10.2 | All | professional | All |
| Operating System | Suse | Suse Linux | 10.2 | All | x86_64 | All |
| Operating System | Suse | Suse Linux | 8.0 | All | retail_solution | All |
| Operating System | Suse | Suse Linux | 9.0 | All | All | All |
| Operating System | Suse | Suse Linux | 9.0 | All | personal | All |
| Operating System | Suse | Suse Linux | 9.0 | All | professional | All |
| Operating System | Suse | Suse Linux | 9.0 | All | x86_64 | All |
| Operating System | Suse | Suse Linux | 9.1 | All | personal | All |
| Operating System | Suse | Suse Linux | 9.1 | All | professional | All |
| Operating System | Suse | Suse Linux | 9.1 | All | x86_64 | All |
| Operating System | Suse | Suse Linux | 9.2 | All | personal | All |
| Operating System | Suse | Suse Linux | 9.2 | All | professional | All |
| Operating System | Suse | Suse Linux | 9.2 | All | x86_64 | All |
| Operating System | Suse | Suse Linux | 9.3 | All | personal | All |
| Operating System | Suse | Suse Linux | 9.3 | All | professional | All |
| Operating System | Suse | Suse Linux | 9.3 | All | x86_64 | All |
| Operating System | Suse | Suse Linux | 10 | All | enterprise_desktop | All |
| Operating System | Suse | Suse Linux | 10 | All | enterprise_server | All |
| Operating System | Suse | Suse Linux | 10.0 | All | oss | All |
| Operating System | Suse | Suse Linux | 10.1 | All | personal | All |
| Operating System | Suse | Suse Linux | 10.1 | All | professional | All |
| Operating System | Suse | Suse Linux | 10.2 | All | professional | All |
| Operating System | Suse | Suse Linux | 10.2 | All | x86_64 | All |
| Operating System | Suse | Suse Linux | 8.0 | All | retail_solution | All |
| Operating System | Suse | Suse Linux | 9.0 | All | All | All |
| Operating System | Suse | Suse Linux | 9.0 | All | personal | All |
| Operating System | Suse | Suse Linux | 9.0 | All | professional | All |
| Operating System | Suse | Suse Linux | 9.0 | All | x86_64 | All |
| Operating System | Suse | Suse Linux | 9.1 | All | personal | All |
| Operating System | Suse | Suse Linux | 9.1 | All | professional | All |
| Operating System | Suse | Suse Linux | 9.1 | All | x86_64 | All |
| Operating System | Suse | Suse Linux | 9.2 | All | personal | All |
| Operating System | Suse | Suse Linux | 9.2 | All | professional | All |
| Operating System | Suse | Suse Linux | 9.2 | All | x86_64 | All |
| Operating System | Suse | Suse Linux | 9.3 | All | personal | All |
| Operating System | Suse | Suse Linux | 9.3 | All | professional | All |
| Operating System | Suse | Suse Linux | 9.3 | All | x86_64 | All |
| Operating System | Suse | Suse Linux | 1.0 | All | desktop | All |
| Operating System | Suse | Suse Linux | 8 | All | enterprise_server | All |
| Operating System | Suse | Suse Linux | 9.0 | All | enterprise_server | All |
| Operating System | Suse | Suse Linux | 1.0 | All | desktop | All |
| Operating System | Suse | Suse Linux | 8 | All | enterprise_server | All |
| Operating System | Suse | Suse Linux | 9.0 | All | enterprise_server | All |
| Application | Suse | Suse Linux Openexchange Server | 4.0 | All | All | All |
| Application | Suse | Suse Linux Openexchange Server | 4.0 | All | All | All |
| Application | Suse | Suse Linux School Server | gold | All | i386 | All |
| Application | Suse | Suse Linux School Server | gold | All | i386 | All |
| Application | Suse | Suse Linux Standard Server | 8.0 | All | All | All |
| Application | Suse | Suse Linux Standard Server | 8.0 | All | All | All |
| Application | Suse | Suse Open Enterprise Server | 9 | All | All | All |
| Application | Suse | Suse Open Enterprise Server | 9 | All | All | All |
| Operating System | Suse | Suse United Linux | 1.0 | All | All | All |
| Operating System | Suse | Suse United Linux | 1.0 | All | All | All |
| Application | Xfsdump | Xfsdump | 2.2.38 | All | All | All |
| Application | Xfsdump | Xfsdump | 2.2.38 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Advisories - Mandriva Linux | MANDRIVA | www.mandriva.com | |
| Mandriva update for xfsdump - Advisories - Secunia | SECUNIA | secunia.com | Vendor Advisory |
| xfsdump "xfs_fsr" Insecure Temporary Directory Creation - Secunia.com | SECUNIA | secunia.com | Vendor Advisory |
| #417894 - xfsdump: xfs_fsr makes world writeable temporary directories - Debian Bug report logs | MISC | bugs.debian.org | Exploit |
| XFSDump XFS_FSR Insecure Temporary File Creation Vulnerability | BID | www.securityfocus.com | |
| Ubuntu update for xfsdump - Advisories - Secunia | SECUNIA | secunia.com | Vendor Advisory |
| SUSE Updates for Multiple Packages - Advisories - Secunia | SECUNIA | secunia.com | Vendor Advisory |
| Security Announcement | SUSE | www.novell.com | Vendor Advisory |
| USN-516-1: xfsdump vulnerability | Ubuntu | UBUNTU | www.ubuntu.com | |
| 36716 | OSVDB | osvdb.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.