National Cyber-Alert System

Vulnerability Summary for CVE-2007-6209

Overview

Util/difflog.pl in zsh 4.3.4 allows local users to overwrite arbitrary files via a symlink attack on temporary files.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Red Hat (12/04/2007)

Not vulnerable. These issues did not affect the versions of the zsh package as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: MISC

Name: https://bugs.gentoo.org/show_bug.cgi?id=201022

Hyperlink:https://bugs.gentoo.org/show_bug.cgi?id=201022

External Source: XF

Name: zsh-difflog-symlink(38812)

Hyperlink:http://xforce.iss.net/xforce/xfdb/38812

External Source: MLIST

Name: [zsh-workers] 20071203 Re: difflog.pl and "security"

Hyperlink:http://www.zsh.org/mla/workers/2007/msg01066.html

External Source: MLIST

Name: [zsh-workers] 20071203 Re: difflog.pl and "security"

Hyperlink:http://www.zsh.org/mla/workers/2007/msg01065.html

External Source: MLIST

Name: [zsh-workers] 20071202 difflog.pl and "security"

Hyperlink:http://www.zsh.org/mla/workers/2007/msg01060.html

External Source: BID

Name: 26674

Hyperlink:http://www.securityfocus.com/bid/26674

External Source: SECUNIA

Name: 27899

Hyperlink:http://secunia.com/advisories/27899

External Source: OSVDB

Name: 42481

Hyperlink:http://osvdb.org/42481