CVE-2008-5302 : Detail

CVE-2008-5302

0.04%V3
Local
2008-12-01
16h00 +00:00
2018-10-11
17h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Race condition in the rmtree function in File::Path 1.08 and 2.07 (lib/File/Path.pm) in Perl 5.8.8 and 5.10.0 allows local users to create arbitrary setuid binaries via a symlink attack, a different vulnerability than CVE-2005-0448, CVE-2004-0452, and CVE-2008-2827. NOTE: this is a regression error related to CVE-2005-0448. It is different from CVE-2008-5303 due to affected versions.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Metrics

Metrics Score Severity CVSS Vector Source
V2 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Products Mentioned

Configuraton 0

Perl>>Perl >> Version 5.8.8

Perl>>Perl >> Version 5.10.0

Perl>>File::path >> Version 1.08

    Perl>>File::path >> Version 2.07

      References

      http://secunia.com/advisories/32980
      Tags : third-party-advisory, x_refsource_SECUNIA
      http://www.debian.org/security/2008/dsa-1678
      Tags : vendor-advisory, x_refsource_DEBIAN
      http://www.ubuntu.com/usn/usn-700-1
      Tags : vendor-advisory, x_refsource_UBUNTU
      http://www.openwall.com/lists/oss-security/2008/11/28/2
      Tags : mailing-list, x_refsource_MLIST
      http://support.apple.com/kb/HT4077
      Tags : x_refsource_CONFIRM
      http://secunia.com/advisories/33314
      Tags : third-party-advisory, x_refsource_SECUNIA
      http://www.ubuntu.com/usn/usn-700-2
      Tags : vendor-advisory, x_refsource_UBUNTU
      http://secunia.com/advisories/40052
      Tags : third-party-advisory, x_refsource_SECUNIA
      http://www.redhat.com/support/errata/RHSA-2010-0458.html
      Tags : vendor-advisory, x_refsource_REDHAT
      http://www.mandriva.com/security/advisories?name=MDVSA-2010:116
      Tags : vendor-advisory, x_refsource_MANDRIVA