National Cyber Awareness System

Vulnerability Summary for CVE-2008-0001

Overview

VFS in the Linux kernel before 2.6.22.16, and 2.6.23.x before 2.6.23.14, performs tests of access mode by using the flag variable instead of the acc_mode variable, which might allow local users to bypass intended permissions and remove directories.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BID

Name: 27280

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/27280

External Source: FEDORA

Name: FEDORA-2008-0748

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00828.html

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-2146

Hyperlink:https://issues.rpath.com/browse/RPL-2146

External Source: XF

Name: linux-directory-security-bypass(39672)

Hyperlink:http://xforce.iss.net/xforce/xfdb/39672

External Source: VUPEN

Name: ADV-2008-0151

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2008/0151

External Source: UBUNTU

Name: USN-578-1

Hyperlink:http://www.ubuntu.com/usn/usn-578-1

External Source: UBUNTU

Name: USN-574-1

Hyperlink:http://www.ubuntu.com/usn/usn-574-1

External Source: BUGTRAQ

Name: 20080117 rPSA-2008-0021-1 kernel

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/486485/100/0/threaded

External Source: REDHAT

Name: RHSA-2008:0089

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0089.html

External Source: MANDRIVA

Name: MDVSA-2008:112

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:112

External Source: MANDRIVA

Name: MDVSA-2008:044

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:044

External Source: CONFIRM

Name: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.23.14

Hyperlink:http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.23.14

External Source: DEBIAN

Name: DSA-1479

Hyperlink:http://www.debian.org/security/2008/dsa-1479

External Source: CONFIRM

Name: http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0021

Hyperlink:http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0021

External Source: SECTRACK

Name: 1019289

Hyperlink:http://securitytracker.com/id?1019289

External Source: SECUNIA

Name: 29245

Type: Advisory

Hyperlink:http://secunia.com/advisories/29245

External Source: SECUNIA

Name: 28971

Type: Advisory

Hyperlink:http://secunia.com/advisories/28971

External Source: SECUNIA

Name: 28806

Type: Advisory

Hyperlink:http://secunia.com/advisories/28806

External Source: SECUNIA

Name: 28748

Type: Advisory

Hyperlink:http://secunia.com/advisories/28748

External Source: SECUNIA

Name: 28706

Type: Advisory

Hyperlink:http://secunia.com/advisories/28706

External Source: SECUNIA

Name: 28664

Type: Advisory

Hyperlink:http://secunia.com/advisories/28664

External Source: SECUNIA

Name: 28643

Type: Advisory

Hyperlink:http://secunia.com/advisories/28643

External Source: SECUNIA

Name: 28628

Type: Advisory

Hyperlink:http://secunia.com/advisories/28628

External Source: SECUNIA

Name: 28626

Type: Advisory

Hyperlink:http://secunia.com/advisories/28626

External Source: SECUNIA

Name: 28558

Type: Advisory

Hyperlink:http://secunia.com/advisories/28558

External Source: SECUNIA

Name: 28485

Type: Advisory

Hyperlink:http://secunia.com/advisories/28485

External Source: REDHAT

Name: RHSA-2008:0055

Hyperlink:http://rhn.redhat.com/errata/RHSA-2008-0055.html

External Source: OVAL

Name: oval:org.mitre.oval:def:9709

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9709

External Source: SUSE

Name: SUSE-SA:2008:013

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00002.html

External Source: SUSE

Name: SUSE-SA:2008:006

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00002.html

External Source: CONFIRM

Name: http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22.16

Hyperlink:http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22.16

External Source: CONFIRM

Name: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=974a9f0b47da74e28f68b9c8645c3786aa5ace1a

Hyperlink:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=974a9f0b47da74e28f68b9c8645c3786aa5ace1a

References to Check Content

Identifier:oval:org.mitre.oval:def:9709

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9709