Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2007-1500: Gentoo Linux LSAT can let local users replace any file

CVE-2007-1500 · published 19 years ago

Summary

The Linux Security Auditing Tool on Gentoo Linux creates temporary files in the shared /tmp folder. A local user can trick it with a symbolic link to overwrite any file on the system, potentially altering important data or settings. Apply the latest update or patch for LSAT and limit write permissions to the temporary directory until the issue is resolved.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
gentoo	linux	All versions `cpe:2.3:o:gentoo:linux::::::::`

Original advisory text

The Linux Security Auditing Tool (LSAT) allows local users to overwrite arbitrary files via a symlink attack on temporary files, as demonstrated using /tmp/lsat1.lsat.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.3 Medium

Exploitation

<1% chance of attack within 30 days

Timeline

Published19 Mar 2007

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2007-1500 · NVD

Track software like this

Free during beta