Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.9

scratchbox2 lets local user replace any file

CVE-2008-4984 · published 18 years ago
Summary

The scratchbox2 tool (version 1.99.0.24) can be tricked by someone with local access to overwrite files of their choice using specially crafted temporary files. This could allow an insider to alter system or application data without permission. Apply the latest updates or patches for scratchbox2 to stop the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
freedesktop scratchbox2 1.99.0.24
cpe:2.3:a:freedesktop:scratchbox2:1.99.0.24:*:*:*:*:*:*:*
Original advisory text
scratchbox2 1.99.0.24 allows local users to overwrite arbitrary files via a symlink attack on (a) /tmp/dpkg.#####.tmp, (b) /tmp/missing_deps.#####, and (c) /tmp/sb2-pkg-chk.$tstamp.##### temporary ...
scratchbox2 1.99.0.24 allows local users to overwrite arbitrary files via a symlink attack on (a) /tmp/dpkg.#####.tmp, (b) /tmp/missing_deps.#####, and (c) /tmp/sb2-pkg-chk.$tstamp.##### temporary files, related to the (1) dpkg-checkbuilddeps and (2) sb2-check-pkg-mappings scripts.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
6.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-59Link Following
Timeline
Published6 Nov 2008
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2008-4984 · NVD
Track software like this
Free during beta