CVE-2015-5224
published 2017-08-23CVE-2015-5224: The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks.
PriorityP346critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
4.53%
90.5th percentile
The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | util-linux | < util-linux 2.27-1 (bookworm) | util-linux 2.27-1 (bookworm) |
| kernel | util-linux | <= 2.26.2 | — |
| kernel | util-linux | — | — |
| kernel | util-linux | >= 0 < 2.27-1 | 2.27-1 |
| kernel | util-linux | >= 0 < 2.27-1 | 2.27-1 |
| kernel | util-linux | >= 0 < 2.27-1 | 2.27-1 |
| kernel | util-linux | >= 0 < 2.27-1 | 2.27-1 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8LOW
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-g2jw-fqx3-5mwq: The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attac
ghsa_unreviewed·2022-05-13
CVE-2015-5224 [CRITICAL] CWE-377 GHSA-g2jw-fqx3-5mwq: The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attac
The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks.
OSV
CVE-2015-5224: The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attac
osv·2017-08-23·CVSS 9.8
CVE-2015-5224 [CRITICAL] CVE-2015-5224: The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attac
The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks.
Red Hat
util-linux: File name collision due to incorrect mkstemp use
vendor_redhat·2015-08-24·CVSS 9.8
CVE-2015-5224 [CRITICAL] util-linux: File name collision due to incorrect mkstemp use
util-linux: File name collision due to incorrect mkstemp use
The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks.
Statement: This issue did not affect the versions of util-linux as shipped with Red Hat Enterprise Linux 5 and 7. This issue does not affect the versions of util-linux-ng as shipped with Red Hat Enterprise Linux 6.
Package: util-linux (Red Hat Enterprise Linux 5) - Not affected
Package: util-linux-ng (Red Hat Enterprise Linux 6) - Not affected
Package: util-linux (Red Hat Enterprise Linux 7) - Not affected
Debian
CVE-2015-5224: util-linux - The mkostemp function in login-utils in util-linux when used incorrectly allows ...
vendor_debian·2015·CVSS 9.8
CVE-2015-5224 [CRITICAL] CVE-2015-5224: util-linux - The mkostemp function in login-utils in util-linux when used incorrectly allows ...
The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly other attacks.
Scope: local
bookworm: resolved (fixed in 2.27-1)
bullseye: resolved (fixed in 2.27-1)
forky: resolved (fixed in 2.27-1)
sid: resolved (fixed in 2.27-1)
trixie: resolved (fixed in 2.27-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-5224 util-linux: File name collision due to incorrect mkstemp use [fedora-all]
bugzilla·2015-08-25·CVSS 9.8
CVE-2015-5224 [CRITICAL] CVE-2015-5224 util-linux: File name collision due to incorrect mkstemp use [fedora-all]
CVE-2015-5224 util-linux: File name collision due to incorrect mkstemp use [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported ve
Bugzilla
CVE-2015-5224 util-linux: File name collision due to incorrect mkstemp use
bugzilla·2015-08-25·CVSS 9.8
CVE-2015-5224 [CRITICAL] CVE-2015-5224 util-linux: File name collision due to incorrect mkstemp use
CVE-2015-5224 util-linux: File name collision due to incorrect mkstemp use
The following vulnerability in util-linux was announced (taken from http://seclists.org/oss-sec/2015/q3/423):
"""
If the chfn and chsh binaries (both setuid-root) from
util-linux/login-utils are compiled WITHOUT libuser support, they
eventually call mkostemp(localtmp, O_RDWR|O_CREAT|O_EXCL|O_CLOEXEC);
where localtmp is "/etc/%s.XXXXXX" and %s is __progname (i.e., argv[0]'s
basename).
An attacker could repeatedly execve chfn as "ld.so" until mkostemp()
creates "/etc/ld.so.preload" (after a few days, in our tests). This
particular example doesn't actually work, because "preload" is 7 chars
and "XXXXXX" is 6 chars, but it seems there are other interesting
possibilities, like "/etc/rc.status" and "/etc/krb5.keytab".
arXiv
Well Begun is Half Done: An Empirical Study of Exploitability & Impact of Base-Image Vulnerabilities
arxiv_fulltext·2021-12-21
Well Begun is Half Done: An Empirical Study of Exploitability & Impact of Base-Image Vulnerabilities
Well Begun is Half Done: An Empirical Study of Exploitability & Impact of Base-Image Vulnerabilities
Mubin Ul Haque2 and
M. Ali Babar 3
Centre for Research on Engineering Software Technologies (CREST)
School of Computer Science, and Engineering, The University of Adelaide, Adelaide, Australia
Cyber Security Cooperative Research Centre, Australia
[email protected], [email protected]
plain
plain
## Abstract
Container technology, (e.g., Docker) is being widely adopted for deploying software infrastructures or applications in the form of container images.
Security vulnerabilities in the container images are a primary concern for developing containerized software.
Exploitation of the vulnerabilities could result in disastrous impact, such as loss of confidentiality, in
http://www.openwall.com/lists/oss-security/2015/08/24/3http://www.securityfocus.com/bid/76467https://bugzilla.redhat.com/show_bug.cgi?id=1256686https://github.com/karelzak/util-linux/commit/bde91c85bdc77975155058276f99d2e0f5eab5a9http://www.openwall.com/lists/oss-security/2015/08/24/3http://www.securityfocus.com/bid/76467https://bugzilla.redhat.com/show_bug.cgi?id=1256686https://github.com/karelzak/util-linux/commit/bde91c85bdc77975155058276f99d2e0f5eab5a9
2017-08-23
Published