CVE-2008-4192
Summary
| CVE | CVE-2008-4192 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2008-09-29 17:17:29 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | The pserver_shutdown function in fence_egenera in cman 2.20080629 and 2.20080801 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/eglog temporary file. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
LocalAccess Complexity
MediumAuthentication
NoneConfidentiality
CompleteIntegrity
CompleteAvailability
CompleteAV:L/AC:M/Au:N/C:C/I:C/A:C
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Cluster Project CMAN "fence_egenera" Insecure Temporary Files - Secunia Advisories - Vulnerability Intelligence - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| oss-security - CVE Request (openswan, emacspeak, cman) | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| Bug 460476 – CVE-2008-4192 cman/fence: insecure temporary file usage in the egenera fence agent | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | |
| [SECURITY] Fedora 9 Update: cman-2.03.08-1.fc9 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| oss-security - Re: CVE Request (openswan, emacspeak, cman) | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| uvw.ru/report.lenny.txt | af854a3a-2127-422b-91ae-364da2661108 | uvw.ru | |
| Fedora update for cman - Secunia Advisories - Vulnerability Intelligence - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| USN-875-1: Red Hat Cluster Suite vulnerabilities | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntu.com | |
| oss-security - CVE requests: tempfile issues for aview, mgetty, openoffice, crossfire | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| 235770 – (debian-tempfile) [Tracker] Tempfile issues found in Debian | af854a3a-2127-422b-91ae-364da2661108 | bugs.gentoo.org | |
| Webmail - OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Vendor Advisory |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| Fedora update for gfs2-utils and rgmanager - Secunia Advisories - Vulnerability Intelligence - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Red Hat update for fence - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| cman 'fence_egenera' Insecure Temporary File Creation Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| 404 Not Found | af854a3a-2127-422b-91ae-364da2661108 | dev.gentoo.org | |
| #496410 - The possibility of attack with the help of symlinks in some Debian packages - Debian Bug report logs | af854a3a-2127-422b-91ae-364da2661108 | bugs.debian.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|---|---|---|
| Red Hat | 2008-10-17 | Tomas Hoger | Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2008-4192 The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here: http://www.redhat.com/security/updates/classification/ |
There are currently no legacy QID mappings associated with this CVE.