CVEvulnerability

CVE-2008-2958

4.4 MEDIUM Published 2008-07-01 Modified 2026-06-16 Official page ↗

Status: Modified
Published: 2008-07-01
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 2.0 ([email protected]): 4.4 MEDIUM — AV:L/AC:M/Au:N/C:P/I:P/A:P
Weaknesses: CWE-362

Description

Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite arbitrary files and have other impacts via symlink and possibly other attacks on temporary working directories.

Affected configurations

• checkinstall checkinstall 1.6.1

Weakness · CWE (1)

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

Referenced by CWE · observed example (2)

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition weakness

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=488140 bugs.debian.org
http://lists.alioth.debian.org/pipermail/secure-testing-team/2008-June/001672.html Exploit
http://secunia.com/advisories/30873 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/43440 exchange.xforce.ibmcloud.com
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=488140 bugs.debian.org
http://lists.alioth.debian.org/pipermail/secure-testing-team/2008-June/001672.html Exploit
http://secunia.com/advisories/30873 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/43440 exchange.xforce.ibmcloud.com