CVE-2009-1297

NameCVE-2009-1297
Descriptioniscsi_discovery in open-iscsi in SUSE openSUSE 10.3 through 11.1 and SUSE Linux Enterprise (SLE) 10 SP2 and 11, and other operating systems, allows local users to overwrite arbitrary files via a symlink attack on an unspecified temporary file that has a predictable name.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs547011

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
open-iscsi (PTS)bullseye2.1.3-5fixed
bookworm2.1.8-1fixed
trixie2.1.11-1+deb13u1fixed
forky, sid2.1.11-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
open-iscsisourceetch(not affected)
open-iscsisourcelenny2.0.870~rc3-0.4.1
open-iscsisource(unstable)2.0.871-1low547011

Notes

[etch] - open-iscsi <not-affected> (Vulnerable script not yet present)
Search for package or bug name: Reporting problems