CVE-2015-0267 Path traversal in n/a

Low 3.6 Published 19 May 2015 Updated 6 Aug 2024

Local attackers can write to arbitrary files via a symlink attack in the kexec-tools setup script, potentially compromising system integrity.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2015-0267?

CVE-2015-0267 is a low-severity path traversal vulnerability in n/a, published on 19 May 2015. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The Red Hat module-setup.sh script for kexec-tools, as distributed in the kexec-tools before 2.0.7-19 packages in Red Hat Enterprise Linux, allows local users to write to arbitrary files via a symlink attack on a temporary file.

Which versions are affected by CVE-2015-0267?

It affects 1 product.

Linux distribution packages (16)

`kexec-tools` Red Hat:enterprise_linux:7::client	All versions	`0:2.0.7-19.el7_1.2`
`kexec-tools-anaconda-addon` Red Hat:enterprise_linux:7::client	All versions	`0:2.0.7-19.el7_1.2`
`kexec-tools-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:2.0.7-19.el7_1.2`
`kexec-tools-eppic` Red Hat:enterprise_linux:7::client	All versions	`0:2.0.7-19.el7_1.2`
`kexec-tools` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.0.7-19.el7_1.2`
`kexec-tools-anaconda-addon` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.0.7-19.el7_1.2`
`kexec-tools-debuginfo` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.0.7-19.el7_1.2`
`kexec-tools-eppic` Red Hat:enterprise_linux:7::computenode	All versions	`0:2.0.7-19.el7_1.2`
`kexec-tools` Red Hat:enterprise_linux:7::server	All versions	`0:2.0.7-19.ael7b_1.2`
`kexec-tools-anaconda-addon` Red Hat:enterprise_linux:7::server	All versions	`0:2.0.7-19.ael7b_1.2`
`kexec-tools-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:2.0.7-19.ael7b_1.2`
`kexec-tools-eppic` Red Hat:enterprise_linux:7::server	All versions	`0:2.0.7-19.ael7b_1.2`
`kexec-tools` Red Hat:enterprise_linux:7::workstation	All versions	`0:2.0.7-19.el7_1.2`
`kexec-tools-anaconda-addon` Red Hat:enterprise_linux:7::workstation	All versions	`0:2.0.7-19.el7_1.2`
`kexec-tools-debuginfo` Red Hat:enterprise_linux:7::workstation	All versions	`0:2.0.7-19.el7_1.2`
`kexec-tools-eppic` Red Hat:enterprise_linux:7::workstation	All versions	`0:2.0.7-19.el7_1.2`

Products include Redhat Kexec-Tools.

How do I fix CVE-2015-0267?

Apply the vendor's patch.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2015-0267 being exploited?

There is no known exploitation of CVE-2015-0267 in the wild and no public exploit code.

Sources

Also known as GHSA-v9pv-3899-728j, RHSA-2015:0986.