Acme Thttpd Insecure Temporary File Creation Vulnerability
BID:15320
Info
Acme Thttpd Insecure Temporary File Creation Vulnerability
| Bugtraq ID: | 15320 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 04 2005 12:00AM |
| Updated: | Nov 04 2005 12:00AM |
| Credit: | Javier Fernández-Sanguino Peña is credited with the discovery of this vulnerability. |
| Vulnerable: |
Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Debian Linux 3.0 sparc Debian Linux 3.0 s/390 Debian Linux 3.0 ppc Debian Linux 3.0 mipsel Debian Linux 3.0 mips Debian Linux 3.0 m68k Debian Linux 3.0 ia-64 Debian Linux 3.0 ia-32 Debian Linux 3.0 hppa Debian Linux 3.0 arm Debian Linux 3.0 alpha Debian Linux 3.0 Acme thttpd 2.23 b1 Acme thttpd 2.21 b |
| Not Vulnerable: | |
Discussion
Acme Thttpd Insecure Temporary File Creation Vulnerability
thttpd creates temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to overwrite files in the context of the Web server process.
Exploitation would most likely result in loss of data or a denial of service if critical files are overwritten in the attack. Other attacks may be possible as well.
thttpd creates temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to overwrite files in the context of the Web server process.
Exploitation would most likely result in loss of data or a denial of service if critical files are overwritten in the attack. Other attacks may be possible as well.
Exploit / POC
Acme Thttpd Insecure Temporary File Creation Vulnerability
An exploit is not required.
An exploit is not required.
Solution / Fix
Acme Thttpd Insecure Temporary File Creation Vulnerability
Solution:
Debian has released security advisory DSA-883-1 to address this issue; please see the referenced advisory for further details.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Debian has released security advisory DSA-883-1 to address this issue; please see the referenced advisory for further details.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Acme Thttpd Insecure Temporary File Creation Vulnerability
References:
References:
- Debian Homepage (Debian)
- mini_httpd Homepage (Acme)
- thttpd Homepage (Acme)