Vulnerability in Ppc64-Diag Project
CVE-2014-4038
ppc64-diag 2.6.1 allows local users to overwrite arbitrary files via a symlink attack related to (1) rtas_errd/diag_support.c and /tmp/get_dt_files, (2) scripts/ppc64_diag_mkrsrc and /tmp/diagSEsnap/snapH.tar.gz, or (3) lpd/test/lpd_ela_test.sh and /var/tmp/ras.
EPSS: 0.004 (27.8th percentile) — read the EPSS interpretation.
Affected products
- Ppc64-diag_project Ppc64-diag — versions 2.6.1
- Redhat Enterprise_linux_server — versions 6.0, 7.0
- Suse Linux_enterprise_server — versions 11
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- cve@mitre.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
- cve@mitre.org (x_refsource_CONFIRM, Issue Tracking)
- cve@mitre.org (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- cve@mitre.org (x_refsource_SECUNIA, third-party-advisory)
- cve@mitre.org (vendor-advisory, Third Party Advisory, x_refsource_SUSE)
- cve@mitre.org (x_refsource_CONFIRM, Issue Tracking)
- cve@mitre.org (vdb-entry, x_refsource_BID)