SimpleCDR-X Insecure Temporary File Creation Vulnerability

Bugtraq ID:	14855
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Sep 15 2005 12:00AM
Updated:	Sep 15 2005 12:00AM
Credit:	<[email protected]> is credited with the discovery of this vulnerability.
Vulnerable:	SimpleCDR-X SimpleCDR-X 1.3.3
Not Vulnerable:

SimpleCDR-X Insecure Temporary File Creation Vulnerability

SimpleCDR-X creates temporary files in an insecure manner.

A local attacker would most likely take advantage of this vulnerability by creating a malicious symbolic link in a directory where the temporary files will be created.

Exploitation would most likely result in loss of data or a denial of service if critical files are overwritten in the attack. Other attacks may also be possible.

SimpleCDR-X 1.3.3 is reported to be vulnerable. Other versions may also be affected.

SimpleCDR-X Insecure Temporary File Creation Vulnerability

There is no exploit required.

SimpleCDR-X Insecure Temporary File Creation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

SimpleCDR-X Insecure Temporary File Creation Vulnerability

References:

• SimpleCDR-X Product Page (SimpleCDR-X)