CVE-2009-0416

2009-02-0323:30:01

CWE-59

mitre

web.nvd.nist.gov

ssl certificate

sblim

sblim-sfcb

cve-2009-0416

symlink attack

security vulnerability

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.2

Confidence

High

EPSS

Percentile

5.1%

JSON

The SSL certificate setup program (genSslCert.sh) in Standards Based Linux Instrumentation for Manageability (SBLIM) sblim-sfcb 1.3.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /var/tmp/key.pem, (2) /var/tmp/cert.pem, and (3) /var/tmp/ssl.cnf temporary files.

Affected configurations

Nvd

Node

standards_based_linux_instrumentationsblim-sfcbMatch1.3.2

VendorProductVersionCPE
standards_based_linux_instrumentationsblim-sfcb1.3.2cpe:2.3:a:standards_based_linux_instrumentation:sblim-sfcb:1.3.2:*:*:*:*:*:*:*