OSVDB ID: 49081

Title: Linux Kernel fs/open.c (f)truncate Function Local Privilege Escalation

Info

Disclosure

Sep 24, 2008

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

Classification

Location: Local Access Required
Impact: Loss of Integrity
Solution: Upgrade
Exploit: Exploit Public
Disclosure: Vendor Verified

Solution

Upgrade to version 2.6.22 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Unknown or Incomplete

References

CVE ID: 2008-4210 (see also: NVD)
Bugtraq ID: 31368
Secunia Advisory ID: 32237 32344 32356 32485 32759 32799 32918 32953 33010 33201 33280 33455
Exploit Database: 6851
Milw0rm: 6851
Vendor Specific News/Changelog Entry: http://bugzilla.kernel.org/show_bug.cgi?id=8420
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.26.y.git;a=commit;h=7b82dc0e64e93f430182f36b46b79fcee87d3532
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00001.html
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22
https://bugzilla.redhat.com/show_bug.cgi?id=463661
https://rhn.redhat.com/errata/RHSA-2008-0972.html
Other Advisory URL: http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.36.8
http://www.openwall.com/lists/oss-security/2008/09/24/5
http://www.openwall.com/lists/oss-security/2008/09/24/8
http://www.us.debian.org/security/2008/dsa-1653
Mail List Post: http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00007.html
RedHat RHSA: http://rhn.redhat.com/errata/RHSA-2008-0787.html
http://rhn.redhat.com/errata/RHSA-2008-0973.html
https://rhn.redhat.com/errata/RHSA-2009-0001.html
Vendor Specific Advisory URL: https://lists.ubuntu.com/archives/ubuntu-security-announce/2008-November/000791.html

Credit

gat3way at gat3way dot eu -

Direct URL: http://osvdb.org/49081