fcrontab in fcron before 3.0.5 allows local users to read arbitrary files via a symlink attack on an unspecified file.
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Link | Tags |
---|---|
http://www.vupen.com/english/advisories/2010/0730 | vdb entry |
http://secunia.com/advisories/39195 | third party advisory |
http://lists.fedoraproject.org/pipermail/package-announce/2010-March/038150.html | vendor advisory |
http://www.securityfocus.com/archive/1/509873/100/0/threaded | mailing list |
http://securitytracker.com/id?1023677 | vdb entry |
https://exchange.xforce.ibmcloud.com/vulnerabilities/56680 | vdb entry |
http://www.osvdb.org/62718 | vdb entry |
http://fcron.free.fr/ | patch |
http://seclists.org/fulldisclosure/2010/Mar/97 | mailing list |
http://secunia.com/advisories/38796 | third party advisory vendor advisory |
http://www.securityfocus.com/bid/38531 | patch vdb entry |