GNU Troff (Groff) Insecure Temporary File Creation Vulnerabilities
BID:12058
Info
GNU Troff (Groff) Insecure Temporary File Creation Vulnerabilities
| Bugtraq ID: | 12058 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 20 2004 12:00AM |
| Updated: | Dec 20 2004 12:00AM |
| Credit: | Discovery is credited to Javier Fernandez-Sanguino <[email protected]>. |
| Vulnerable: |
GNU groff 1.18 |
| Not Vulnerable: | |
Discussion
GNU Troff (Groff) Insecure Temporary File Creation Vulnerabilities
GNU Troff (groff) is affected by multiple insecure temporary file creation vulnerabilities. These issues are due to a design error that causes the application to fail to verify the existence of a file before writing to it.
An attacker may leverage these issues to overwrite arbitrary files with the privileges of an unsuspecting user that activates the vulnerable application.
GNU Troff (groff) 1.18 is reported vulnerable to these issues. Other versions are likely to be vulnerable as well. This BID will be updated when more information becomes available.
GNU Troff (groff) is affected by multiple insecure temporary file creation vulnerabilities. These issues are due to a design error that causes the application to fail to verify the existence of a file before writing to it.
An attacker may leverage these issues to overwrite arbitrary files with the privileges of an unsuspecting user that activates the vulnerable application.
GNU Troff (groff) 1.18 is reported vulnerable to these issues. Other versions are likely to be vulnerable as well. This BID will be updated when more information becomes available.
Exploit / POC
GNU Troff (Groff) Insecure Temporary File Creation Vulnerabilities
An exploit is not required.
An exploit is not required.
Solution / Fix
GNU Troff (Groff) Insecure Temporary File Creation Vulnerabilities
Solution:
Ubuntu has released advisory USN-43-1 to address these issues. Please see the referenced advisory for more information.
GNU groff 1.18
Solution:
Ubuntu has released advisory USN-43-1 to address these issues. Please see the referenced advisory for more information.
GNU groff 1.18
-
Ubuntu groff-base_1.18.1.1-1ubuntu0.2_amd64.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/g/groff/groff-base_1.18.1. 1-1ubuntu0.2_amd64.deb -
Ubuntu groff-base_1.18.1.1-1ubuntu0.2_i386.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/g/groff/groff-base_1.18.1. 1-1ubuntu0.2_i386.deb -
Ubuntu groff-base_1.18.1.1-1ubuntu0.2_powerpc.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/g/groff/groff-base_1.18.1. 1-1ubuntu0.2_powerpc.deb -
Ubuntu groff_1.18.1.1-1ubuntu0.2_amd64.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/g/groff/groff_1.18.1.1-1ub untu0.2_amd64.deb -
Ubuntu groff_1.18.1.1-1ubuntu0.2_i386.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/g/groff/groff_1.18.1.1-1ub untu0.2_i386.deb -
Ubuntu groff_1.18.1.1-1ubuntu0.2_powerpc.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/g/groff/groff_1.18.1.1-1ub untu0.2_powerpc.deb
References
GNU Troff (Groff) Insecure Temporary File Creation Vulnerabilities
References:
References: