CVE-2007-3919

Published: Oct 28, 2007Modified: Apr 23, 2026

6.0

Vector

AV:L/AC:M/Au:S/C:N/I:C/A:C

Exploitability: 2.7 / Impact: 9.2

Source: NVD

Description

(1) xenbaked and (2) xenmon.py in Xen 3.1 and earlier allow local users to truncate arbitrary files via a symlink attack on /tmp/xenq-shm.

Affected (2)

Products: Xensource Inc: Xen

1 product

Configuration A

2 vulnerable · 12 platform

Vulnerable Software	Affected Versions
Xensource Inc Xen	Version 3.0.3_0_1
Xensource Inc Xen	Version 3.0.3_0_3

Running on/with	Platform Versions
Debian Debian Linux	Version 4.0
Debian Debian Linux	Version 4.0
Debian Debian Linux	Version 4.0
Debian Debian Linux	Version 4.0
Debian Debian Linux	Version 4.0
Debian Debian Linux	Version 4.0
Debian Debian Linux	Version 4.0
Debian Debian Linux	Version 4.0
Debian Debian Linux	Version 4.0
Debian Debian Linux	Version 4.0
Debian Debian Linux	Version 4.0
Debian Debian Linux	Version 4.0

Related CWEs

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (36)

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=447795

Source: cve@mitre.org

http://osvdb.org/41342

Source: cve@mitre.org

http://osvdb.org/41343

Source: cve@mitre.org

http://secunia.com/advisories/27389

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27408

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/27486

Source: cve@mitre.org

http://secunia.com/advisories/27497

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29963

Source: cve@mitre.org

http://www.debian.org/security/2007/dsa-1395

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDKSA-2007:203

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2008-0194.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/26190

Source: cve@mitre.org

http://www.securitytracker.com/id?1018859

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/3621

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/37403

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9913

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00004.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00075.html

Source: cve@mitre.org

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=447795

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/41342

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/41343

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/27389

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/27408

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/27486

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/27497

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/29963

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2007/dsa-1395

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDKSA-2007:203

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2008-0194.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/26190

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1018859

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2007/3621

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/37403

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9913

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00004.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00075.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.