CVE-2008-5302

Severity: medium (CVSS 6.9 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-12-01 · updated 2026-06-16
Weakness: CWE-362

Description

Race condition in the rmtree function in File::Path 1.08 and 2.07 (lib/File/Path.pm) in Perl 5.8.8 and 5.10.0 allows local users to create arbitrary setuid binaries via a symlink attack, a different vulnerability than CVE-2005-0448, CVE-2004-0452, and CVE-2008-2827. NOTE: this is a regression error related to CVE-2005-0448. It is different from CVE-2008-5303 due to affected versions.

Affected products

perl File::Path: 1.08, 2.07

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286905
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=286922#36
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
http://secunia.com/advisories/32980
http://secunia.com/advisories/33314
http://secunia.com/advisories/40052
http://support.apple.com/kb/HT4077
http://wiki.rpath.com/Advisories:rPSA-2009-0011
http://www.debian.org/security/2008/dsa-1678

Get alerted when CVE-2008-5302 or the next vulnerability affects your stack