GNU GLibC Insecure Temporary File Creation Vulnerability

BID:11286

Info

GNU GLibC Insecure Temporary File Creation Vulnerability

Bugtraq ID: 11286
Class: Design Error
CVE: CVE-2004-0968
Remote: No
Local: Yes
Published: Sep 30 2004 12:00AM
Updated: Aug 05 2010 07:45PM
Credit: Trustix security engineers are credited with the discovery of this vulnerability.
Vulnerable: SGI ProPack 3.0
Redhat Enterprise Linux WS 3
Redhat Enterprise Linux ES 3
Redhat Enterprise Linux AS 3
Redhat Desktop 3.0
GNU glibc 2.3.10
+ Debian Linux 2.2
GNU glibc 2.3.4
GNU glibc 2.3.3
+ MandrakeSoft apcupsd 2006.0
 + Mandriva Linux Mandrake 10.1 x86_64
 + Mandriva Linux Mandrake 10.1
+ Mandriva Linux Mandrake 10.0 AMD64
 + Mandriva Linux Mandrake 10.0
+ Redhat Fedora Core2
 GNU glibc 2.3.2
+ Redhat Linux 9.0 i386
 + Redhat Linux 8.0
+ Trustix Secure Linux 2.0
+ Ubuntu Ubuntu Linux 4.1 ppc
 + Ubuntu Ubuntu Linux 4.1 ia64
 + Ubuntu Ubuntu Linux 4.1 ia32
 GNU glibc 2.3.1
+ Mandriva Linux Mandrake 9.1 ppc
 + Mandriva Linux Mandrake 9.1
+ Slackware Linux 9.0
GNU glibc 2.3
GNU glibc 2.2.5
+ Debian Linux 3.0 sparc
 + Debian Linux 3.0 s/390
 + Debian Linux 3.0 ppc
 + Debian Linux 3.0 mipsel
 + Debian Linux 3.0 mips
 + Debian Linux 3.0 m68k
 + Debian Linux 3.0 ia-64
 + Debian Linux 3.0 ia-32
 + Debian Linux 3.0 hppa
 + Debian Linux 3.0 arm
 + Debian Linux 3.0 alpha
 + Debian Linux 3.0
+ Gentoo Linux 0.7
+ Gentoo Linux 0.5
+ MandrakeSoft Corporate Server 2.1 x86_64
 + MandrakeSoft Corporate Server 2.1
+ Mandriva Linux Mandrake 9.0
+ Redhat Linux 7.3 i386
 + Redhat Linux 7.3
+ Slackware Linux 8.1
GNU glibc 2.2.4
+ Caldera OpenLinux Server 3.1.1
+ Caldera OpenLinux Server 3.1
+ Caldera OpenLinux Workstation 3.1.1
+ Caldera OpenLinux Workstation 3.1
+ HP Secure OS software for Linux 1.0
+ Mandriva Linux Mandrake 8.2 ppc
 + Mandriva Linux Mandrake 8.2
+ Mandriva Linux Mandrake 8.1 ia64
 + Mandriva Linux Mandrake 8.1
+ Redhat Enterprise Linux AS 2.1 IA64
 + Redhat Enterprise Linux AS 2.1
 + Redhat Enterprise Linux ES 2.1 IA64
 + Redhat Enterprise Linux ES 2.1
 + Redhat Enterprise Linux WS 2.1 IA64
 + Redhat Enterprise Linux WS 2.1
 + Redhat Linux 7.2 i686
 + Redhat Linux 7.2 i386
 + Redhat Linux 7.1 ia64
 + Redhat Linux 7.1 i686
 + Redhat Linux 7.1 i386
 + Redhat Linux 7.1 alphaev6
 + Redhat Linux 7.1 alpha
 + Redhat Linux 7.0 alphaev6
 + Redhat Linux 7.0 i686
 + Redhat Linux 7.0 i386
 + Redhat Linux 7.0 alpha
 + Redhat Linux Advanced Work Station 2.1
+ S.u.S.E. Linux Database Server 0
 + S.u.S.E. Linux Enterprise Server for S/390
+ S.u.S.E. Linux Firewall on CD
+ S.u.S.E. SuSE eMail Server III
+ Sun Linux 5.0.7
+ Sun Linux 5.0.6
+ Sun Linux 5.0.5
+ Sun Linux 5.0.3
+ Sun Linux 5.0
+ SuSE Linux 8.0 i386
 + SuSE Linux 8.0
+ SuSE Linux 7.3 sparc
 + SuSE Linux 7.3 ppc
 + SuSE Linux 7.3 i386
 + SuSE Linux 7.3
+ SuSE SUSE Linux Enterprise Server 7
 GNU glibc 2.2.3
GNU glibc 2.2.2
+ Mandriva Linux Mandrake 8.0 ppc
 + Mandriva Linux Mandrake 8.0
+ SuSE Linux 7.2 i386
 + SuSE Linux 7.2
GNU glibc 2.2.1
GNU glibc 2.2
+ SuSE Linux 7.1 x86
 + SuSE Linux 7.1 sparc
 + SuSE Linux 7.1 ppc
 + SuSE Linux 7.1 alpha
 + SuSE Linux 7.1
+ Wirex Immunix OS 7+
 GNU glibc 2.1.9 and Greater
GNU glibc 2.1.9
GNU glibc 2.1.3 -10
+ Debian Linux 2.2
GNU glibc 2.1.3
+ Debian Linux 2.2 sparc
 + Debian Linux 2.2 powerpc
 + Debian Linux 2.2 IA-32
 + Debian Linux 2.2 arm
 + Debian Linux 2.2 alpha
 + Debian Linux 2.2 68k
 + Debian Linux 2.2
+ EnGarde Secure Linux 1.0.1
+ HP Secure OS software for Linux 1.0
+ MandrakeSoft Corporate Server 1.0.1
+ MandrakeSoft Single Network Firewall 7.2
+ Mandriva Linux Mandrake 7.2
+ Mandriva Linux Mandrake 7.1
+ Openwall Openwall GNU/*/Linux 0.1 -stable
 + Redhat Linux 6.2 sparcv9
 + Redhat Linux 6.2 sparc
 + Redhat Linux 6.2 i386
 + Redhat Linux 6.2 alpha
 + Redhat Linux 6.2
 + SuSE Linux 7.0 sparc
 + SuSE Linux 7.0 ppc
 + SuSE Linux 7.0 i386
 + SuSE Linux 7.0 alpha
 + SuSE Linux 7.0
+ SuSE Linux 6.4 ppc
 + SuSE Linux 6.4 i386
 + SuSE Linux 6.4 alpha
 + SuSE Linux 6.4
+ Trustix Secure Linux 1.5
+ Trustix Secure Linux 1.2
+ Trustix Secure Linux 1.1
+ Trustix Secure Linux 1.0 1
 GNU glibc 2.1.2
GNU glibc 2.1.1 -6
+ Redhat Linux 6.0
GNU glibc 2.1.1
GNU glibc 2.1
GNU glibc 2.0.6
GNU glibc 2.0.5
GNU glibc 2.0.4
GNU glibc 2.0.3
GNU glibc 2.0.2
GNU glibc 2.0.1
GNU glibc 2.0
Avaya S8710 R2.0.1
Avaya S8710 R2.0.0
Avaya S8700 R2.0.1
Avaya S8700 R2.0.0
Avaya S8500 R2.0.1
Avaya S8500 R2.0.0
Avaya S8300 R2.0.1
Avaya S8300 R2.0.0
Avaya Network Routing
Avaya Modular Messaging (MSS) 2.0
Avaya Modular Messaging (MSS) 1.1
Avaya MN100
Avaya Intuity LX
Avaya Integrated Management 2.1
Avaya Integrated Management
Avaya CVLAN
Avaya Converged Communications Server 2.0
Not Vulnerable:

Discussion

GNU GLibC Insecure Temporary File Creation Vulnerability

GNU glibc is affected by an insecure temporary file creation vulnerability. This issue is likely due to a design error that causes the application to fail to verify the existence of a file before writing to it.

An attacker may leverage this issue to overwrite arbitrary files with the privileges of an unsuspecting user that activates the vulnerable application. Reportedly this issue is unlikely to facilitate privilege escalation.

Exploit / POC

GNU GLibC Insecure Temporary File Creation Vulnerability

No exploit is required to leverage this issue.

Solution / Fix

GNU GLibC Insecure Temporary File Creation Vulnerability

Solution:
Avaya has released an advisory (ASA-2005-011_RHSA-2004-586) that acknowledges this vulnerability for Avaya products. Please see the referenced Avaya advisory for further details.

SGI has released advisory 20050102-01-U to address various issues in SGI Advanced Linux Environment 3. This advisory includes updated SGI ProPack 3 Service Pack 3 packages (patch10132.tar.gz). Please see the referenced advisory for more information.

Red Hat has released advisory RHSA-2004:586-15 and fixes to address this issue on Red Hat Linux Enterprise platforms. Customers that are affected by this issue are advised to apply the appropriate updates. Customers subscribed to the Red Hat Network may apply the appropriate fixes using the Red Hat Update Agent (up2date). Please see referenced advisory for additional information.

Trustix Linux has released an advisory (TSL-2004-0050) along with fixes dealing with this issue. Please see the referenced advisory for more information.

Gentoo has released an advisory (GLSA 200410-19) to address this issue. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to update their computers:

emerge sync
emerge -pv sys-libs/glibc
emerge sys-libs/glibc

For more information, please see the referenced Gentoo Linux advisory.

Ubuntu Linux has released advisory USN-4-1 dealing with this issue. Please see the referenced advisory for more information.

RedHat Fedora Linux has released advisory FEDORA-2004-356 along with fixes dealing with this issue. Please see the referenced advisory for more information.

Mandrake Linux has released advisory MDKSA-2004:159 dealing with this issue. Please see the referenced advisory for more information.

Debian Linux has released advisory DSA 636-1 along with fixes dealing with this issue. Please see the referenced advisory for more information.

Avaya has released advisory ASA-2005-155 to identify vulnerable Avaya products. Avaya recommends that customers should install vendor upgrades depending on the underlying operating systems running Avaya products.


GNU glibc 2.1.3

GNU glibc 2.2.5

GNU glibc 2.3.2

GNU glibc 2.3.3

SGI ProPack 3.0

References

GNU GLibC Insecure Temporary File Creation Vulnerability

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report