CVE-2009-3289

HighCVSS 7.8/10Last modified Jun 16, 2026

Description

The g_file_copy function in glib 2.0 sets the permissions of a target file to the permissions of a symbolic link (777), which allows user-assisted local users to modify files of other users, as demonstrated by using Nautilus to modify the permissions of the user home directory.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.htmlThird Party Advisory
http://secunia.com/advisories/39656Broken Link
http://www.openwall.com/lists/oss-security/2009/09/08/8Mailing List
http://www.vupen.com/english/advisories/2010/1001Permissions Required
https://bugs.launchpad.net/ubuntu/+source/glib2.0/+bug/418135Exploit, Issue Tracking
https://bugzilla.gnome.org/show_bug.cgi?id=593406Exploit, Issue Tracking
http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00006.htmlThird Party Advisory
http://secunia.com/advisories/39656Broken Link
http://www.openwall.com/lists/oss-security/2009/09/08/8Mailing List
http://www.vupen.com/english/advisories/2010/1001Permissions Required
https://bugs.launchpad.net/ubuntu/+source/glib2.0/+bug/418135Exploit, Issue Tracking
https://bugzilla.gnome.org/show_bug.cgi?id=593406Exploit, Issue Tracking

Timeline

Published: Sep 22, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-32907.2The kvm_emulate_hypercall function in arch/x86/kvm/x86.c in KVM in the Linux kernel 2.6.25-rc1, and other versions before 2.6.31, when runni CVE-2009-32917.5The php_openssl_apply_verification_policy function in PHP before 5.2.11 does not properly perform certificate validation, which has unknown CVE-2009-32927.5Unspecified vulnerability in PHP before 5.2.11, and 5.3.x before 5.3.1, has unknown impact and attack vectors related to "missing sanity che CVE-2009-32937.5Unspecified vulnerability in the imagecolortransparent function in PHP before 5.2.11 has unknown impact and attack vectors related to an inc CVE-2009-32945.0The popen API function in TSRM/tsrm_win32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, CVE-2009-32955.0The prep_reprocess_req function in kdc/do_tgs_req.c in the cross-realm referral implementation in the Key Distribution Center (KDC) in MIT K CVE-2009-32967.5Multiple integer overflows in tiffread.c in CamlImages 2.2 might allow remote attackers to execute arbitrary code via TIFF images containing CVE-2009-32986.5Mahara before 1.0.13, and 1.1.x before 1.1.7, allows remote authenticated institution administrators to reset a site administrator password CVE-2009-32994.3Cross-site scripting (XSS) vulnerability in the resume blocktype in Mahara before 1.0.13, and 1.1.x before 1.1.7, allows remote attackers to CVE-2009-33002.6Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service CVE-2009-33019.3Integer underflow in filter/ww8/ww8par2.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to cause a denial of service (applica CVE-2009-33029.3filter/ww8/ww8par2.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to cause a denial of service (application crash) or possib