Description
Race condition in GNU nano before 2.2.4, when run by root to edit a file that is not owned by root, allows local user-assisted attackers to change the ownership of arbitrary files via vectors related to the creation of backup files.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://lists.gnu.org/archive/html/nano-devel/2010-04/msg00000.html ↗
- http://svn.savannah.gnu.org/viewvc/trunk/nano/ChangeLog?revision=4503&root=nano&view=markup ↗
- http://www.openwall.com/lists/oss-security/2010/04/14/4 ↗
- http://www.securitytracker.com/id?1023891 ↗
- http://drosenbe.blogspot.com/2010/03/nano-as-root.html ↗
- http://secunia.com/advisories/39444 ↗