Arbitrary File Overwrite

2019-01-1508:50:51

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.0004 Low

EPSS

Percentile

5.1%

JSON

sanlock is vulnerable to arbitrary file overwrite attacks. The vulnerability exists as the setup_logging function in log.h in SANLock uses world-writable permissions for /var/log/sanlock.log, which allows local users to overwrite the file content or bypass intended disk-quota restrictions via standard filesystem write operations.

CPENameOperatorVersion
sanlockeq2.2__1.el6
sanlockeq1.8__2.el6
sanlockeq2.3__1.el6
gluster-swifteq1.4.8__4.el6
gluster-swifteq1.4.8__3.el6
glusterfseq3.3.0.6rhs__2.el6
glusterfseq3.2.6__1.el6
glusterfseq3.2.5__2.el6
glusterfseq3.3.0qa30__1.el6
glusterfseq3.3.0.2rhs__30.el6rhs

Name	Operator	Version
sanlock	eq	2.2__1.el6
sanlock	eq	1.8__2.el6
sanlock	eq	2.3__1.el6
gluster-swift	eq	1.4.8__4.el6
gluster-swift	eq	1.4.8__3.el6
glusterfs	eq	3.3.0.6rhs__2.el6
glusterfs	eq	3.2.6__1.el6
glusterfs	eq	3.2.5__2.el6
glusterfs	eq	3.3.0qa30__1.el6
glusterfs	eq	3.3.0.2rhs__30.el6rhs