CVE Feed

    Dashboard / CVE / CVE-2008-5302

    CVE-2008-5302

    Race condition in the rmtree function in File::Path 1.08 and 2.07 (lib/File/Path.pm) in Perl 5.8.8 and 5.10.0 allows local users to create arbitrary setuid binaries via a symlink attack, a different vulnerability than CVE-2005-0448, CVE-2004-0452, and CVE-2008-2827. NOTE: this is a regression error related to CVE-2005-0448. It is different from CVE-2008-5303 due to affected versions.

    Published:Nov 19, 2008
    Last Modified:Apr 23, 2026
    EPS:Dec 1, 2008
    EPSS Score:0.00047
    CVSS Score:6.9

    Affected Products

    Vendor
    Perl
    Product
    File\
    Vendor
    Perl
    Product
    Perl
    Vendor
    Redhat
    Product
    Enterprise Linux

    Exploits

    http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286905http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286922#36http://www.gossamer-threads.com/lists/perl/porters/233695#233695http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286905http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286922#36http://www.gossamer-threads.com/lists/perl/porters/233695#233695

    References

    http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286905
    http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286922#36
    http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
    http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
    http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
    http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
    http://secunia.com/advisories/32980
    http://secunia.com/advisories/33314
    http://secunia.com/advisories/40052
    http://support.apple.com/kb/HT4077
    http://wiki.rpath.com/Advisories:rPSA-2009-0011
    http://www.debian.org/security/2008/dsa-1678
    http://www.gossamer-threads.com/lists/perl/porters/233695#233695
    http://www.mandriva.com/security/advisories?name=MDVSA-2010:116
    http://www.openwall.com/lists/oss-security/2008/11/28/2
    http://www.redhat.com/support/errata/RHSA-2010-0458.html
    http://www.securityfocus.com/archive/1/500210/100/0/threaded
    http://www.ubuntu.com/usn/usn-700-1
    http://www.ubuntu.com/usn/usn-700-2
    https://exchange.xforce.ibmcloud.com/vulnerabilities/47043
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11076
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6890
    http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286905
    http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286922#36
    http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
    http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
    http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
    http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
    http://secunia.com/advisories/32980
    http://secunia.com/advisories/33314
    http://secunia.com/advisories/40052
    http://support.apple.com/kb/HT4077
    http://wiki.rpath.com/Advisories:rPSA-2009-0011
    http://www.debian.org/security/2008/dsa-1678
    http://www.gossamer-threads.com/lists/perl/porters/233695#233695
    http://www.mandriva.com/security/advisories?name=MDVSA-2010:116
    http://www.openwall.com/lists/oss-security/2008/11/28/2
    http://www.redhat.com/support/errata/RHSA-2010-0458.html
    http://www.securityfocus.com/archive/1/500210/100/0/threaded
    http://www.ubuntu.com/usn/usn-700-1
    http://www.ubuntu.com/usn/usn-700-2
    https://exchange.xforce.ibmcloud.com/vulnerabilities/47043
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11076
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6890

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High