Symlink Attack

2020-04-1000:58:24

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.0004 Low

EPSS

Percentile

5.1%

JSON

Bash (Bourne-again shell) is the default shell for Red Hat Enterprise Linux. It was found that certain scripts bundled with the Bash documentation created temporary files in an insecure way. A malicious, local user could use this flaw to conduct a symbolic link attack, allowing them to overwrite the contents of arbitrary files accessible to the victim running the scripts.

CPENameOperatorVersion
basheq3.0__21.el4
basheq3.2__24.1.el5sjis
basheq3.2__24.2.el5sjis
basheq3.2__21.el5
basheq3.0__21.el4_8.2
basheq3.2__24.el5
basheq3.0__19.7.el4_7.1
basheq3.0__21.el4
basheq3.2__24.1.el5sjis
basheq3.2__24.2.el5sjis

Name	Operator	Version
bash	eq	3.0__21.el4
bash	eq	3.2__24.1.el5sjis
bash	eq	3.2__24.2.el5sjis
bash	eq	3.2__21.el5
bash	eq	3.0__21.el4_8.2
bash	eq	3.2__24.el5
bash	eq	3.0__19.7.el4_7.1
bash	eq	3.0__21.el4
bash	eq	3.2__24.1.el5sjis
bash	eq	3.2__24.2.el5sjis