CVE-2009-1215

Published: Apr 1, 2009Modified: Apr 23, 2026

1.9

Vector

AV:L/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 3.4 / Impact: 2.9

Source: NVD

Description

Race condition in GNU screen 4.0.3 allows local users to create or overwrite arbitrary files via a symlink attack on the /tmp/screen-exchange temporary file.

Affected (1)

Products: Gnu: Gnu Screen

Gnu

1 product

Gnu Screen

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gnu Gnu Screen	Version 4.0.3

Related CWEs

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References (14)

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521123

Source: cve@mitre.org

http://savannah.gnu.org/bugs/?25296

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2009/03/25/7

Source: cve@mitre.org

http://www.securityfocus.com/bid/34521

Source: cve@mitre.org

https://bugs.launchpad.net/ubuntu/+source/screen/+bug/315993

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=492104

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/49887

Source: cve@mitre.org

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=521123