CVE-2008-0884 — Incorrect Permission Assignment in Redhat Enterprise Linux
Severity
6.9MEDIUMNVD
EPSS
0.0%
top 90.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 4
Latest updateMay 1
Description
The Replace function in the capp-lspp-config script in the (1) lspp-eal4-config-ibm and (2) capp-lspp-eal4-config-hp packages before 0.65-2 in Red Hat Enterprise Linux (RHEL) 5 uses lstat instead of stat to determine the /etc/pam.d/system-auth file permissions, leading to a change to world-writable permissions for the /etc/pam.d/system-auth-ac file, which allows local users to gain privileges by modifying this file.
CVSS vector
AV:L/AC:M/C:C/I:C/A:CExploitability: 3.4 | Impact: 10.0
Affected Packages0 packages
Also affects: Enterprise Linux 5.0
🔴Vulnerability Details
1GHSA▶
GHSA-ph72-92xv-q7vm: The Replace function in the capp-lspp-config script in the (1) lspp-eal4-config-ibm and (2) capp-lspp-eal4-config-hp packages before 0↗2022-05-01