nsr_shutdown in Fujitsu Siemens NetWorker 6.0 allows local users to overwrite arbitrary files via a symlink attack on the nsrsh[PID] temporary file.
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Link | Tags |
---|---|
http://securityreason.com/securityalert/3353 | third party advisory exploit |
http://www.securityfocus.com/bid/9446 | vdb entry |
http://www.securitytracker.com/id?1008801 | vdb entry |
http://www.securityfocus.com/archive/1/350237/30/21640/threaded | mailing list |