CVE-2008-1570 Race condition in n/a

Medium 6.9 Published 31 Mar 2008 Updated 7 Aug 2024

Local attackers can exploit a race condition in policyd-weight to modify or delete arbitrary files, potentially leading to privilege escalation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2008-1570?

CVE-2008-1570 is a medium-severity vulnerability in n/a, published on 31 Mar 2008. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Race condition in the create_lockpath function in policyd-weight 0.1.14 beta-16 allows local users to modify or delete arbitrary files by creating the LOCKPATH directory, then modifying it after the symbolic link check occurs. NOTE: this is due to an incomplete fix for CVE-2008-1569.

Weakness: CWE-362

Which versions are affected by CVE-2008-1570?

It affects 1 product.

Products include Policyd-Weight Policyd-Weight.

How do I fix CVE-2008-1570?

Apply the vendor's patch.

Is CVE-2008-1570 being exploited?

There is no known exploitation of CVE-2008-1570 in the wild and no public exploit code.

CVE-2008-1569 Path traversal in n/a Low 3.3

Sources

Also known as DEBIAN-CVE-2008-1570, GHSA-72h5-35jc-jq88.