The Ubuntu SELinux initscript before version 1:0.10 used touch to create a lockfile in a world-writable directory. If the OS kernel does not have symlink protections then an attacker can cause a zero byte file to be allocated on any writable filesystem.
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Selinux | Canonical | * | 1:0.10 (excluding) |
| Selinux | Ubuntu | lucid | * |
| Selinux | Ubuntu | precise | * |
| Selinux | Ubuntu | upstream | * |