The init script for Apache Geronimo on SUSE Linux follows symlinks when performing a chown operation, which might allow local users to obtain access to unspecified files or directories.
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Link | Tags |
---|---|
http://secunia.com/advisories/28838 | third party advisory patch vendor advisory |
http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00003.html | patch vendor advisory |