Emacs flim Library Insecure Temporary File Creation Vulnerability
BID:10259
Info
Emacs flim Library Insecure Temporary File Creation Vulnerability
| Bugtraq ID: | 10259 |
| Class: | Race Condition Error |
| CVE: |
CVE-2004-0422 |
| Remote: | No |
| Local: | Yes |
| Published: | May 02 2004 12:00AM |
| Updated: | Jul 12 2009 04:07AM |
| Credit: | Discovery is credited to Tatsuya Kinoshita. |
| Vulnerable: |
Redhat Fedora Core2 GNU Emacs 21.2 GNU Emacs 20.6 GNU Emacs 20.6 GNU Emacs 20.5 GNU Emacs 20.4 GNU Emacs 20.3 GNU Emacs 20.2 GNU Emacs 20.1 GNU Emacs 20.0 Debian Linux 3.0 sparc Debian Linux 3.0 s/390 Debian Linux 3.0 ppc Debian Linux 3.0 mipsel Debian Linux 3.0 mips Debian Linux 3.0 m68k Debian Linux 3.0 ia-64 Debian Linux 3.0 ia-32 Debian Linux 3.0 hppa Debian Linux 3.0 arm Debian Linux 3.0 alpha Debian Linux 3.0 |
| Not Vulnerable: | |
Discussion
Emacs flim Library Insecure Temporary File Creation Vulnerability
The Emacs flim library is prone to a symlink vulnerability. This could allow files to be overwritten with the privileges of the user running Emacs.
The Emacs flim library is prone to a symlink vulnerability. This could allow files to be overwritten with the privileges of the user running Emacs.
Exploit / POC
Emacs flim Library Insecure Temporary File Creation Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Emacs flim Library Insecure Temporary File Creation Vulnerability
Solution:
Debian has released an advisory (DSA 500-1) and fixes for this issue. See the referenced advisory for links to fixed packages.
RedHat has released an advisory (RHSA-2004:344-04) to address this issue in Red Hat Enterprise Linux. Please see the advisory in Web references for more information.
Red Hat has released a Fedora legacy advisory (FLSA:1581) to address this issue in flim. This advisory fixes the issue in Red Hat Linux 7.3 and 9 running on the i386 architecture. Please see the referenced advisory for more details and information about obtaining fixes.
Red Hat Fedora has released an advisory dealing with this issue for their Core 2 product. Please see the referenced advisory for more information.
Redhat Fedora Core2
Debian Linux 3.0
Solution:
Debian has released an advisory (DSA 500-1) and fixes for this issue. See the referenced advisory for links to fixed packages.
RedHat has released an advisory (RHSA-2004:344-04) to address this issue in Red Hat Enterprise Linux. Please see the advisory in Web references for more information.
Red Hat has released a Fedora legacy advisory (FLSA:1581) to address this issue in flim. This advisory fixes the issue in Red Hat Linux 7.3 and 9 running on the i386 architecture. Please see the referenced advisory for more details and information about obtaining fixes.
Red Hat Fedora has released an advisory dealing with this issue for their Core 2 product. Please see the referenced advisory for more information.
Redhat Fedora Core2
-
RedHat flim-1.14.7-0.FC2.noarch.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/i386 /flim-1.14.7-0.FC2.noarch.rpm -
RedHat flim-1.14.7-0.FC2.noarch.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/x86_ 64/flim-1.14.7-0.FC2.noarch.rpm
Debian Linux 3.0
-
Debian flim_1.14.3-9woody1_all.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/f/flim/flim_1.14.3-9woody 1_all.deb
References
Emacs flim Library Insecure Temporary File Creation Vulnerability
References:
References: