Vulnerability Description
xfs_fsr in xfsdump creates a .fsr temporary directory with insecure permissions, which allows local users to read or overwrite arbitrary files on xfs filesystems.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Suse | Suse Linux | 1.0 |
| Suse | Suse United Linux | 1.0 |
| Suse | Suse Linux Openexchange Server | 4.0 |
| Suse | Suse Linux School Server | gold |
| Suse | Suse Linux Standard Server | 8.0 |
| Suse | Suse Open Enterprise Server | 9 |
| Xfsdump | Xfsdump | 2.2.38 |
| Suse | Opensuse | 10.2 |
Related Weaknesses (CWE)
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=417894Exploit
- http://osvdb.org/36716
- http://secunia.com/advisories/25220Vendor Advisory
- http://secunia.com/advisories/25425Vendor Advisory
- http://secunia.com/advisories/25761Vendor Advisory
- http://secunia.com/advisories/26867Vendor Advisory
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:134
- http://www.novell.com/linux/security/advisories/2007_10_sr.htmlVendor Advisory
- http://www.securityfocus.com/bid/23922
- http://www.ubuntu.com/usn/usn-516-1
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=417894Exploit
- http://osvdb.org/36716
- http://secunia.com/advisories/25220Vendor Advisory
- http://secunia.com/advisories/25425Vendor Advisory
- http://secunia.com/advisories/25761Vendor Advisory
FAQ
What is CVE-2007-2654?
CVE-2007-2654 is a vulnerability with a CVSS score of 4.4 (MEDIUM). xfs_fsr in xfsdump creates a .fsr temporary directory with insecure permissions, which allows local users to read or overwrite arbitrary files on xfs filesystems.
How severe is CVE-2007-2654?
CVE-2007-2654 has been rated MEDIUM with a CVSS base score of 4.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2007-2654?
Check the references section above for vendor advisories and patch information. Affected products include: Suse Suse Linux, Suse Suse United Linux, Suse Suse Linux Openexchange Server, Suse Suse Linux School Server, Suse Suse Linux Standard Server.