Ncompress Insecure Temporary File Creation Vulnerability
BID:14859
Info
Ncompress Insecure Temporary File Creation Vulnerability
| Bugtraq ID: | 14859 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Sep 16 2005 12:00AM |
| Updated: | Sep 16 2005 12:00AM |
| Credit: | D1g1t4lLeech and [email protected] are credited with the discovery of this vulnerability. |
| Vulnerable: |
ncompress ncompress 4.2.4 |
| Not Vulnerable: | |
Discussion
Ncompress Insecure Temporary File Creation Vulnerability
Ncompress creates temporary files in an insecure manner.
A local attacker would most likely take advantage of this vulnerability by creating a malicious symbolic link in a directory where the temporary files will be created.
Exploitation would most likely result in loss of data or a denial of service if critical files are overwritten in the attack. Other attacks may also be possible.
The vulnerability is reported in version 4.2.4. Other versions may also be affected.
Ncompress creates temporary files in an insecure manner.
A local attacker would most likely take advantage of this vulnerability by creating a malicious symbolic link in a directory where the temporary files will be created.
Exploitation would most likely result in loss of data or a denial of service if critical files are overwritten in the attack. Other attacks may also be possible.
The vulnerability is reported in version 4.2.4. Other versions may also be affected.
Exploit / POC
Ncompress Insecure Temporary File Creation Vulnerability
There is no exploit required.
There is no exploit required.
Solution / Fix
Ncompress Insecure Temporary File Creation Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Ncompress Insecure Temporary File Creation Vulnerability
References:
References:
- Ncompress FTP download site (Ncompress)
- RedHat RPM (RedHat)