Debian DHIS-TOOLS-DNS Insecure Temporary File Creation Vulnerability

Bugtraq ID:	16065
Class:	Design Error
CVE:	CVE-2005-3341
Remote:	No
Local:	Yes
Published:	Dec 27 2005 12:00AM
Updated:	May 18 2006 10:08PM
Credit:	Discovered by Javier Fernandez-Sanguino Pena.
Vulnerable:	Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Debian Linux 3.0 sparc Debian Linux 3.0 s/390 Debian Linux 3.0 ppc Debian Linux 3.0 mipsel Debian Linux 3.0 mips Debian Linux 3.0 m68k Debian Linux 3.0 ia-64 Debian Linux 3.0 ia-32 Debian Linux 3.0 hppa Debian Linux 3.0 arm Debian Linux 3.0 alpha Debian Linux 3.0 Debian dhis-tools-dns 5.0
Not Vulnerable:	Debian dhis-tools-dns 5.0 -5 Debian dhis-tools-dns 5.0 -3

Debian DHIS-TOOLS-DNS Insecure Temporary File Creation Vulnerability

Debian dhis-tools-dns creates temporary files in an insecure manner.

Exploitation would most likely result in loss of data or a denial of service if critical files are overwritten in the attack. Other attacks may be possible as well.

Release 5.0 of dhis-tools-dns is vulnerable to this issue.

Debian DHIS-TOOLS-DNS Insecure Temporary File Creation Vulnerability

An exploit is not required.

Debian DHIS-TOOLS-DNS Insecure Temporary File Creation Vulnerability

Solution:
Debian has released advisory DSA 928-1 to address this issue. Please see the referenced advisory for more information.

Debian DHIS-TOOLS-DNS Insecure Temporary File Creation Vulnerability

References:

• dhis-tools-dns (Debian)