Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.2
CVE-2008-5135: os-prober lets local users replace any file
CVE-2008-5135 · published 17 years ago
Summary
The os-prober tool version 1.17 on Debian can be tricked by an ordinary user into overwriting files by creating a special shortcut (symbolic link) to its temporary files. This could let the user change system settings or lose data. Update to a newer, fixed version or restrict regular users from running os-prober until the issue is patched.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | os-prober | All versions |
| Debian:13 | debian | os-prober | All versions |
| Debian:14 | debian | os-prober | All versions |
| – | debian | os-prober |
1.17 cpe:2.3:a:debian:os-prober:1.17:*:*:*:*:*:*:* |
Original advisory text
os-prober in os-prober 1.17 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/mounted-map or (2) /tmp/raided-map temporary file. NOTE: the vendor disputes this i...
os-prober in os-prober 1.17 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/mounted-map or (2) /tmp/raided-map temporary file. NOTE: the vendor disputes this issue, stating "the insecure code path should only ever run inside a d-i environment, which has no non-root users.
Severity
6.2
Medium
Type
CWE-59Link Following
Timeline
Published18 Nov 2008
Updated4 Nov 2026
First seen20 Sep 2026
Track software like this
Free during beta