CVE-2008-3524

Published: Sep 29, 2008Modified: Apr 23, 2026

4.7

Vector

AV:L/AC:M/Au:N/C:N/I:N/A:C

Exploitability: 3.4 / Impact: 6.9

Source: NVD

Description

rc.sysinit in initscripts before 8.76.3-1 on Fedora 9 and other Linux platforms allows local users to delete arbitrary files via a symlink attack on a file or directory under (1) /var/lock or (2) /var/run.

Affected (2)

Products: Redhat: Fedora, Initscripts

Redhat

2 products

Fedora

Initscripts

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Fedora	Version 9
Redhat Initscripts	Version 8.76.3

Related CWEs

CWE-59

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (18)

http://secunia.com/advisories/32037

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/32710

Source: secalert@redhat.com

http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0318

Source: secalert@redhat.com

http://www.securityfocus.com/bid/31385

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=458504

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=458652

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/45402

Source: secalert@redhat.com

https://issues.rpath.com/browse/RPL-2857

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2008-September/msg01135.html

Source: secalert@redhat.com

http://secunia.com/advisories/32037