Description
The (1) post and (2) trigger scripts in sysstat 4.0.7 and earlier allow local users to overwrite arbitrary files via symlink attacks on temporary files, a different vulnerability than CVE-2004-0108.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sysstat | 5.0.2-1 | — |
| Debian 13 | sysstat | 5.0.2-1 | — |
| Debian 12 | sysstat | 5.0.2-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | sysstat | 4.0.7-4.EL3.2 | RHSA-2004:053 |
Advisories 1
- RHSA-2004:053 Red Hat Security Advisory: sysstat security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- RHSA-2004:093 vendor-advisory
- O-097 third-party-advisory government-resource
- oval:org.mitre.oval:def:10737 vdb-entry signature
- sysstat-post-trigger-symlink(15428) vdb-entry
- 9838 vdb-entry
- oval:org.mitre.oval:def:862 vdb-entry signature
- oval:org.mitre.oval:def:849 vdb-entry signature
- RHSA-2004:053 vendor-advisory
- 6884 vdb-entry