CVE-2007-2654

Severity: medium (CVSS 4.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-05-14 · updated 2026-06-16
Weakness: CWE-362

Description

xfs_fsr in xfsdump creates a .fsr temporary directory with insecure permissions, which allows local users to read or overwrite arbitrary files on xfs filesystems.

Affected products

SUSE openSUSE: 10.2
Suse Linux: 1.0, 8, 9.0
Suse Linux Openexchange Server: 4.0
Suse Linux School Server: gold
Suse Linux Standard Server: 8.0
Suse Open Enterprise Server: 9
Xfsdump: 2.2.38

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=417894
http://osvdb.org/36716
http://secunia.com/advisories/25220
http://secunia.com/advisories/25425
http://secunia.com/advisories/25761
http://secunia.com/advisories/26867
http://www.mandriva.com/security/advisories?name=MDKSA-2007:134
http://www.novell.com/linux/security/advisories/2007_10_sr.html
http://www.securityfocus.com/bid/23922
http://www.ubuntu.com/usn/usn-516-1
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=417894
http://osvdb.org/36716

Get alerted when CVE-2007-2654 or the next vulnerability affects your stack