CVE-2004-0497

Description

Unknown vulnerability in Linux kernel 2.x may allow local users to modify the group ID of files, such as NFS exported files in kernel 2.4.

Affected products

• conectiva / linux10 – 10
• gentoo / linux
• Linux / Linux kernel2.0 – 2.0
• mandrakesoft / mandrake_linux9.1 – 9.1
• mandrakesoft / mandrake_linux9.2 – 9.2
• mandrakesoft / mandrake_linux10.0 – 10.0
• mandrakesoft / mandrake_linux_corporate_server2.1 – 2.1
• mandrakesoft / mandrake_multi_network_firewall8.2 – 8.2
• RedHat / enterprise_linux3.0 – 3.0
• RedHat / enterprise_linux2.1 – 2.1
• RedHat / enterprise_linux2.1 – 2.1
• RedHat / enterprise_linux2.1 – 2.1
• RedHat / enterprise_linux3.0 – 3.0
• RedHat / enterprise_linux3.0 – 3.0
• SUSE / suse_linux8.0 – 8.0
• SUSE / suse_linux8.1 – 8.1
• SUSE / suse_linux8.2 – 8.2
• SUSE / suse_linux9.0 – 9.0
• SUSE / suse_linux9.1 – 9.1
• trustix / secure_linux2 – 2
• trustix / secure_linux2.0 – 2.0
• trustix / secure_linux2.1 – 2.1

Exploits & proofs of concept

• exploit-dbLinux Kernel < 2.6.7-rc3 (Slackware 9.1 / Debian 3.0) - 'sys_chown()' Group Ownership Alteration Privilege Escalationby Marco Ivaldi

References

• MISChttp://www.redhat.com/support/errata/RHSA-2004-354.html
• MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/16599
• MISChttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9867
• MISChttp://www.redhat.com/support/errata/RHSA-2004-360.html
• VENDOR_ADVISORYhttp://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:066
• MISChttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000852
• VENDOR_ADVISORYhttp://www.novell.com/linux/security/advisories/2004_20_kernel.html