GNU GetText Unspecified Insecure Temporary File Creation Vulnerability
BID:11282
Info
GNU GetText Unspecified Insecure Temporary File Creation Vulnerability
| Bugtraq ID: | 11282 |
| Class: | Design Error |
| CVE: |
CVE-2004-0966 |
| Remote: | No |
| Local: | Yes |
| Published: | Sep 30 2004 12:00AM |
| Updated: | Dec 14 2006 06:43PM |
| Credit: | The individual or individuals responsible for the discovery of this issue is currently unknown; Trustix security engineers are credited with these discoveries. |
| Vulnerable: |
Ubuntu Ubuntu Linux 4.1 ppc Ubuntu Ubuntu Linux 4.1 ia64 Ubuntu Ubuntu Linux 4.1 ia32 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 GNU gettext 0.14.1 GNU gettext 0.13.1 |
| Not Vulnerable: | |
Discussion
GNU GetText Unspecified Insecure Temporary File Creation Vulnerability
GNU 'gettext' is affected by an unspecified insecure temporary file-creation vulnerability. This issue is likely due to a design error that causes the application to fail to verify the presence of a file before writing to it.
An attacker may leverage this issue to overwrite arbitrary files with the privileges of an unsuspecting user that activates the vulnerable application. Reportedly this issue is unlikely to facilitate privilege escalation.
GNU 'gettext' is affected by an unspecified insecure temporary file-creation vulnerability. This issue is likely due to a design error that causes the application to fail to verify the presence of a file before writing to it.
An attacker may leverage this issue to overwrite arbitrary files with the privileges of an unsuspecting user that activates the vulnerable application. Reportedly this issue is unlikely to facilitate privilege escalation.
Exploit / POC
GNU GetText Unspecified Insecure Temporary File Creation Vulnerability
No exploit is required to leverage this issue.
No exploit is required to leverage this issue.
Solution / Fix
GNU GetText Unspecified Insecure Temporary File Creation Vulnerability
Solution:
See the referenced vendor advisories for details on obtaining and applying the appropriate updates.
GNU gettext 0.13.1
GNU gettext 0.14.1
Solution:
See the referenced vendor advisories for details on obtaining and applying the appropriate updates.
GNU gettext 0.13.1
-
Mandriva gettext-0.13.1-1.3.C30mdk.i586.rpm
Corporate 3.0:
http://www.mandriva.com/en/download -
Mandriva gettext-0.13.1-1.3.C30mdk.src.rpm
Corporate 3.0:
http://www.mandriva.com/en/download -
Mandriva gettext-0.13.1-1.3.C30mdk.x86_64.rpm
Corporate 3.0:
http://www.mandriva.com/en/download -
Mandriva gettext-base-0.13.1-1.3.C30mdk.i586.rpm
Corporate 3.0:
http://www.mandriva.com/en/download -
Mandriva gettext-base-0.13.1-1.3.C30mdk.x86_64.rpm
Corporate 3.0:
http://www.mandriva.com/en/download -
Mandriva gettext-devel-0.13.1-1.3.C30mdk.i586.rpm
Corporate 3.0:
http://www.mandriva.com/en/download -
Mandriva gettext-devel-0.13.1-1.3.C30mdk.x86_64.rpm
Corporate 3.0:
http://www.mandriva.com/en/download -
Mandriva gettext-java-0.13.1-1.3.C30mdk.i586.rpm
Corporate 3.0:
http://www.mandriva.com/en/download -
Mandriva gettext-java-0.13.1-1.3.C30mdk.x86_64.rpm
Corporate 3.0:
http://www.mandriva.com/en/download -
Mandriva lib64gettextmisc-0.13.1-1.3.C30mdk.x86_64.rpm
Corporate 3.0:
http://www.mandriva.com/en/download -
Mandriva lib64intl2-0.13.1-1.3.C30mdk.x86_64.rpm
Corporate 3.0:
http://www.mandriva.com/en/download -
Mandriva libgettextmisc-0.13.1-1.3.C30mdk.i586.rpm
Corporate 3.0:
http://www.mandriva.com/en/download -
Mandriva libintl2-0.13.1-1.3.C30mdk.i586.rpm
Corporate 3.0:
http://www.mandriva.com/en/download -
Ubuntu gettext-base_0.14.1-2ubuntu0.1_amd64.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext-base_0.1 4.1-2ubuntu0.1_amd64.deb -
Ubuntu gettext-base_0.14.1-2ubuntu0.1_i386.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext-base_0.1 4.1-2ubuntu0.1_i386.deb -
Ubuntu gettext-base_0.14.1-2ubuntu0.1_powerpc.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext-base_0.1 4.1-2ubuntu0.1_powerpc.deb -
Ubuntu gettext-doc_0.14.1-2ubuntu0.1_all.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext-doc_0.14 .1-2ubuntu0.1_all.deb -
Ubuntu gettext-el_0.14.1-2ubuntu0.1_all.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext-el_0.14. 1-2ubuntu0.1_all.deb -
Ubuntu gettext_0.14.1-2ubuntu0.1_amd64.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext_0.14.1-2 ubuntu0.1_amd64.deb -
Ubuntu gettext_0.14.1-2ubuntu0.1_i386.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext_0.14.1-2 ubuntu0.1_i386.deb -
Ubuntu gettext_0.14.1-2ubuntu0.1_powerpc.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext_0.14.1-2 ubuntu0.1_powerpc.deb
GNU gettext 0.14.1
-
Trustix gettext-0.14.1-4tr.i586.rpm
Trustix Secure Linux 2.1 & Enterprise Server 2
ftp://ftp.trustix.org/pub/trustix/updates/
References
GNU GetText Unspecified Insecure Temporary File Creation Vulnerability
References:
References: