Flexbackup Multiple Insecure Temporary File Creation Vulnerabilities

Bugtraq ID:	15116
Class:	Design Error
CVE:	CVE-2005-2965
Remote:	No
Local:	Yes
Published:	Oct 17 2005 12:00AM
Updated:	Jan 09 2007 06:21PM
Credit:	Eric Romang is credited with the discovery of this vulnerability.
Vulnerable:	Flexbackup Flexbackup 1.2.1 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1
Not Vulnerable:

Flexbackup Multiple Insecure Temporary File Creation Vulnerabilities

Flexbackup creates several temporary files in an insecure manner.

Exploitation would most likely result in loss of data or a denial of service if critical files are overwritten in the attack. Other attacks may be possible as well.

Flexbackup 1.2.1 and earlier versions are affected.

Flexbackup Multiple Insecure Temporary File Creation Vulnerabilities

No exploit is required.

Flexbackup Multiple Insecure Temporary File Creation Vulnerabilities

Solution:
Please see the referenced advisories for more information.


Flexbackup Flexbackup 1.2.1

• Debian flexbackup_1.2.1-2sarge1_all.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/f/flexbackup/flexbackup_1 .2.1-2sarge1_all.deb

Flexbackup Multiple Insecure Temporary File Creation Vulnerabilities

References:

• Flexbackup Web Site (Flexbackup)
  
• Gentoo Bug Report 105000 (Gentoo)
  
• ZATAZ Flexbackup Advisory (ZATAZ)
  
• flexbackup default config insecure temporary file creation ([email protected])