Debian Security Advisory
DSA-022-1 exmh -- local insecure tempfile creation
- Date Reported:
- 26 Jan 2001
- Affected Packages:
- exmh
- Vulnerable:
- Yes
- Security database references:
- In the Bugtraq database (at SecurityFocus): BugTraq ID 2327.
In Mitre's CVE dictionary: CVE-2001-0125. - More information:
- Former versions of the exmh program used /tmp for storing
temporary files. No checks were made to ensure that nobody placed a symlink
with the same name in /tmp in the meantime and thus was vulnerable to a symlink
attack. This could lead to a malicious local user being able to overwrite any
file writable by the user executing exmh. Upstream developers have reported and
fixed this. The exmh program now use /tmp/login unless TMPDIR or EXMHTMPDIR
is set.
We recommend you upgrade your exmh packages immediately.
- Fixed in:
-
Debian 2.2 (potato)
- Source:
-
http://security.debian.org/dists/stable/updates/main/source/exmh_2.1.1-1.1.diff.gz
-
http://security.debian.org/dists/stable/updates/main/source/exmh_2.1.1-1.1.dsc
-
http://security.debian.org/dists/stable/updates/main/source/exmh_2.1.1.orig.tar.gz
- Architecture-independent component:
-
http://security.debian.org/dists/stable/updates/main/binary-all/exmh_2.1.1-1.1_all.deb