The g_file_copy function in glib 2.0 sets the permissions of a target file to the permissions of a symbolic link (777), which allows user-assisted local users to modify files of other users, as demonstrated by using Nautilus to modify the permissions of the user home directory.

When copying symbolic links the g_file_copy function set the target of the link to mode 0777 therefore exposing potentially sensitive information or allowing other user to modify files they should not have access to (CVE-2009-3289). This has been fixed.

This update also fixes a problem where glib2 couldn't access remote URLs when run outside of a GNOME session.

The when copying symbolic links the g_file_copy function set the target of the link to mode 0777 therefore exposing potentially sensitive information or allowing other user to modify files they should not have access to (CVE-2009-3289).

This update also fixes a problem where glib2 couldn't access remote URLs when run outside of a gnome session.

The when copying symbolic links the g_file_copy function set the target of the link to mode 0777 therefore exposing potentially sensitive information or allowing other user to modify files they should not have access to (CVE-2009-3289).

Arand Nash discovered that applications linked to GLib (e.g. Nautilus) did not correctly copy symlinks. If a user copied symlinks with GLib, the symlink target files would become world-writable, allowing local attackers to gain access to potentially sensitive information.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability was discovered and corrected in glib2.0 :

The g_file_copy function in glib 2.0 sets the permissions of a target file to the permissions of a symbolic link (777), which allows user-assisted local users to modify files of other users, as demonstrated by using Nautilus to modify the permissions of the user home directory (CVE-2009-3289).

This update provides a solution to this vulnerability.

ID	Name	Product	Family	Severity
50911	SuSE 11 Security Update : glib2 (SAT Patch Number 1831)	Nessus	SuSE Local Security Checks	medium
46010	openSUSE Security Update : glib2 (openSUSE-SU-2010:0156-1)	Nessus	SuSE Local Security Checks	medium
46007	openSUSE Security Update : glib2 (openSUSE-SU-2010:0155-1)	Nessus	SuSE Local Security Checks	medium
42043	Ubuntu 8.04 LTS / 8.10 / 9.04 : glib2.0 vulnerability (USN-841-1)	Nessus	Ubuntu Local Security Checks	medium
41619	Mandriva Linux Security Advisory : glib2.0 (MDVSA-2009:245)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2009-3289

high

Tenable Plugins

medium

medium

medium

medium

medium