WmFrog Insecure Temporary File Creation Vulnerability

Bugtraq ID:	24504
Class:	Race Condition Error
CVE:	CVE-2004-2473
Remote:	No
Local:	Yes
Published:	Jun 18 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	The vendor reported this issue.
Vulnerable:	wmFrog Weather Monitor 0.1.6
Not Vulnerable:	wmFrog Weather Monitor 0.2

WmFrog Insecure Temporary File Creation Vulnerability

The WmFrog application creates temporary files in an insecure manner.

An attacker with local access could potentially exploit this issue to perform symlink attacks, overwriting arbitrary files in the context of the affected application.

An attacker may leverage this issue to corrupt or overwrite arbitrary files with the privileges of an unsuspecting user that activated the affected application. Reportedly, attackers can exploit this issue to escalate privileges.

Versions prior to WmFrog 0.2.0 are vulnerable to this issue.

WmFrog Insecure Temporary File Creation Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

WmFrog Insecure Temporary File Creation Vulnerability

Solution:
The vendor released an update to address this issue. Please see the references for more information.

WmFrog Insecure Temporary File Creation Vulnerability

References:

• Changes Version 0.2.0 (WmFrog)
  
• wmFrog Home Page (wmFrog)