CVE-2009-1297 Path traversal in n/a
Local attackers can overwrite arbitrary files via a symlink attack on a predictable temporary file in the open-iscsi discovery process.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-1297?
CVE-2009-1297 is a medium-severity path traversal vulnerability in Opensuse Opensuse, published on 23 Oct 2009. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
iscsi_discovery in open-iscsi in SUSE openSUSE 10.3 through 11.1 and SUSE Linux Enterprise (SLE) 10 SP2 and 11, and other operating systems, allows local users to overwrite arbitrary files via a symlink attack on an unspecified temporary file that has a predictable name.
Weakness: CWE-59
Which versions are affected by CVE-2009-1297?
It affects 2 products.
Products include Novell Suse Linux, Opensuse Opensuse.
How do I fix CVE-2009-1297?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2009-1297 being exploited?
There is no known exploitation of CVE-2009-1297 in the wild and no public exploit code.
Other vulnerabilities in Opensuse Opensuse
Sources
Also known as DEBIAN-CVE-2009-1297, GHSA-ph28-8h48-j3qp.