Smb4k Insecure Temporary File Creation Vulnerability

Bugtraq ID:	14756
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Sep 07 2005 12:00AM
Updated:	Sep 07 2005 12:00AM
Credit:	Announced by the vendor.
Vulnerable:	Smb4k Smb4k 0.6.3 Smb4k Smb4k 0.6 Smb4k Smb4k 0.5.1 Smb4k Smb4k 0.5 Smb4k Smb4k 0.4
Not Vulnerable:

Smb4k Insecure Temporary File Creation Vulnerability

Smb4k is prone to an insecure temporary file creation vulnerability. Successful exploitation of this issue could allow a local attacker to gain access to sensitive information.

Smb4k Insecure Temporary File Creation Vulnerability

An exploit is not required.

Smb4k Insecure Temporary File Creation Vulnerability

Solution:
Mandriva has released advisory MDKSA-2005:157 and fixes to address this issue. Please see the referenced advisory for links to fixed packages.

The vendor has addressed this issue in Smb4k 0.6.3. Patches are also available for previous versions:

Gentoo has released advisory GLSA 200511-15 and fixes to address this issue. Please see the referenced advisory for links to fixed packages.


Smb4k Smb4k 0.4

• Mandriva smb4k-0.4.0-3.1.101mdk.i586.rpm
  Mandrakelinux 10.1
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva smb4k-0.5.1-1.1.102mdk.i586.rpm
  Mandrakelinux 10.1
  http://www1.mandrivalinux.com/en/ftp.php3


• Smb4k 001_security_fix_smb4k_0.4.1a.diff.gz
  http://download.berlios.de/smb4k/001_security_fix_smb4k_0.4.1a.diff.gz

Smb4k Smb4k 0.5.1

• Mandriva smb4k-0.5.1-1.1.102mdk.i586.rpm
  Mandrakelinux 10.1
  http://www1.mandrivalinux.com/en/ftp.php3

Smb4k Smb4k 0.6

• Smb4k smb4k-0.6.3.tar.gz
  http://download.berlios.de/smb4k/smb4k-0.6.3.tar.gz

Smb4k Insecure Temporary File Creation Vulnerability

References:

• Home Page (Smb4k)