← Back

CVE-2008-0525

nvd nist
Published: Jan 31, 2008Modified: Apr 23, 2026

JSON object

Loading...
4.6
Vector
AV:L/AC:L/Au:N/C:P/I:P/A:P
Exploitability: 3.9 / Impact: 6.4
Source: NVD

Description

PatchLink Update client for Unix, as used by Novell ZENworks Patch Management Update Agent for Linux/Unix/Mac (LUM) 6.2094 through 6.4102 and other products, allows local users to (1) truncate arbitrary files via a symlink attack on the /tmp/patchlink.tmp file used by the logtrimmer script, and (2) execute arbitrary code via a symlink attack on the /tmp/plshutdown file used by the rebootTask script.

Affected (18)

Lumension Security
1 product
Patchlink Update
Novell
1 product
Zenworks Patch Management Update Agent
Configuration A
18 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Patchlink Update
Version 6.2
Patchlink Update
Version 6.2
Patchlink Update
Version 6.2
Patchlink Update
Version 6.3
Patchlink Update
Version 6.3
Patchlink Update
Version 6.3
Patchlink Update
Version 6.4
Patchlink Update
Version 6.4
Patchlink Update
Version 6.4
Novell
Zenworks Patch Management Update Agent
Version 6.2
Zenworks Patch Management Update Agent
Version 6.2
Zenworks Patch Management Update Agent
Version 6.2
Zenworks Patch Management Update Agent
Version 6.3
Zenworks Patch Management Update Agent
Version 6.3
Zenworks Patch Management Update Agent
Version 6.3
Zenworks Patch Management Update Agent
Version 6.4
Zenworks Patch Management Update Agent
Version 6.4
Zenworks Patch Management Update Agent
Version 6.4
Running on/withPlatform Versions
Unix
Unix
All versions

Related CWEs

CWE-59
Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (26)

Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.