CVE-2008-6552: fedoraproject fedora Link Following

CVSS: 6.9v2.0MediumModified

AliasesRHSA-2009:1337RHSA-2009:1339RHSA-2011:0265

Published 30-03-2009Last modified 07-08-2024

Vulnerability summary

CVE-2008-6552 is a medium (CVSS 6.9) Link Following vulnerability in fedoraproject fedora. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.3% of scored vulnerabilities.

Overall risk

28/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.9/10

010

Medium · v2.0 (NVD)

EPSS score

0.38%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2

RHSA-2009:1341 RHSA-2011:0264

Timeline

30-03-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.

CVSS metrics

1 score · 1 source · 1 version

v2.06.9

EPSS trend

Probability

0.38%

Chance of exploitation in the next 30 days

Percentile

30%

Versus all other CVEs

30-day change

0.00 pp

From 0.38% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.38%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Affected systems

Redhat11 products

cluster_project2.00.00 | 2.01.00 | 2.02.00 | 2.03.00 | 2.03.01 | 2.03.03 | 2.03.04 | 2.03.05 | 2.03.7 | 2.03.08 | 2.03.09 | 2.03.10 | 2.03.11 | 2.99.00 | 2.99.01 | 2.99.02 | 2.99.03 | 2.99.04 | 2.99.05 | 2.99.06 | 2.99.07 | 2.99.08 | 2.99.09 | 2.99.10 | 2.99.11 | 2.99.12 | 2.99.13
cman2.03.03-1 | 2.03.04-1 | 2.03.05-1 | 2.03.07-1 | 2.03.08-1
gfs2-utils2.03.03-1 | 2.03.04-1 | 2.03.05-1 | 2.03.07-1 | 22.03.08-1
rgmanager2.03.03-1 | 2.03.04-1 | 2.03.05-1 | 2.03.07-1 | 2.03.08-1
ccs< 0:1.0.13-2

Show all 11

Fedoraproject1 product

fedoraEOL9

2 vendors · 12 products

References

73 links

secunia.com/advisories/32616Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2011/0416VDB EntryX Refsource VUPEN
www.redhat.com/support/errata/RHSA-2009-1341.htmlVendor AdvisoryX Refsource REDHAT
www.redhat.com/support/errata/RHSA-2011-0264.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/36555Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/bid/32179VDB EntryX Refsource BID
www.redhat.com/archives/fedora-package-announce/2008-November/msg00163.htmlVendor AdvisoryX Refsource FEDORA
www.vupen.com/english/advisories/2011/0417VDB EntryX Refsource VUPEN
secunia.com/advisories/32602Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/43372Third Party AdvisoryX Refsource SECUNIA

Show all 73 references

www.ubuntu.com/usn/USN-875-1Vendor AdvisoryX Refsource UBUNTU
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11404VDB EntrySignatureX Refsource OVAL
www.redhat.com/archives/fedora-package-announce/2008-November/msg00165.htmlVendor AdvisoryX Refsource FEDORA
osvdb.org/50300VDB EntryX Refsource OSVDB
rhn.redhat.com/errata/RHSA-2009-1337.htmlVendor AdvisoryX Refsource REDHAT
www.redhat.com/support/errata/RHSA-2011-0265.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/43367Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2008-November/msg00164.htmlVendor AdvisoryX Refsource FEDORA
exchange.xforce.ibmcloud.com/vulnerabilities/46412VDB EntryX Refsource XF
secunia.com/advisories/36530Third Party AdvisoryX Refsource SECUNIA
osvdb.org/50301VDB EntryX Refsource OSVDB
www.redhat.com/support/errata/RHSA-2009-1339.htmlVendor AdvisoryX Refsource REDHAT
osvdb.org/50299VDB EntryX Refsource OSVDB
access.redhat.com/errata/RHSA-2009:1337Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=242701REPORT
bugzilla.redhat.com/show_bug.cgi?id=469773REPORT
bugzilla.redhat.com/show_bug.cgi?id=474705REPORT
bugzilla.redhat.com/show_bug.cgi?id=474707REPORT
bugzilla.redhat.com/show_bug.cgi?id=477072REPORT
bugzilla.redhat.com/show_bug.cgi?id=481762REPORT
bugzilla.redhat.com/show_bug.cgi?id=483799REPORT
bugzilla.redhat.com/show_bug.cgi?id=485761REPORT
bugzilla.redhat.com/show_bug.cgi?id=486034REPORT
bugzilla.redhat.com/show_bug.cgi?id=487608REPORT
bugzilla.redhat.com/show_bug.cgi?id=498646REPORT
bugzilla.redhat.com/show_bug.cgi?id=501732REPORT
bugzilla.redhat.com/show_bug.cgi?id=502056REPORT
bugzilla.redhat.com/show_bug.cgi?id=506629REPORT
bugzilla.redhat.com/show_bug.cgi?id=510758REPORT
bugzilla.redhat.com/show_bug.cgi?id=519436REPORT
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1337.jsonAdvisory
access.redhat.com/security/cve/CVE-2008-6552REPORT
www.cve.org/CVERecord?id=CVE-2008-6552Advisory
nvd.nist.gov/vuln/detail/CVE-2008-6552Advisory
access.redhat.com/errata/RHSA-2009:1339Advisory
bugzilla.redhat.com/show_bug.cgi?id=250718REPORT
bugzilla.redhat.com/show_bug.cgi?id=412911REPORT
bugzilla.redhat.com/show_bug.cgi?id=449394REPORT
bugzilla.redhat.com/show_bug.cgi?id=468691REPORT
bugzilla.redhat.com/show_bug.cgi?id=470917REPORT
bugzilla.redhat.com/show_bug.cgi?id=471066REPORT
bugzilla.redhat.com/show_bug.cgi?id=471226REPORT
bugzilla.redhat.com/show_bug.cgi?id=471431REPORT
bugzilla.redhat.com/show_bug.cgi?id=474444REPORT
bugzilla.redhat.com/show_bug.cgi?id=475826REPORT
bugzilla.redhat.com/show_bug.cgi?id=481058REPORT
bugzilla.redhat.com/show_bug.cgi?id=482858REPORT
bugzilla.redhat.com/show_bug.cgi?id=483093REPORT
bugzilla.redhat.com/show_bug.cgi?id=486349REPORT
bugzilla.redhat.com/show_bug.cgi?id=486717REPORT
bugzilla.redhat.com/show_bug.cgi?id=488714REPORT
bugzilla.redhat.com/show_bug.cgi?id=489785REPORT
bugzilla.redhat.com/show_bug.cgi?id=490449REPORT
bugzilla.redhat.com/show_bug.cgi?id=490455REPORT
bugzilla.redhat.com/show_bug.cgi?id=492828REPORT
bugzilla.redhat.com/show_bug.cgi?id=494977REPORT
bugzilla.redhat.com/show_bug.cgi?id=505340REPORT
bugzilla.redhat.com/show_bug.cgi?id=514044REPORT
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1339.jsonAdvisory
access.redhat.com/errata/RHSA-2011:0265Advisory
bugzilla.redhat.com/show_bug.cgi?id=498980REPORT
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0265.jsonAdvisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities