po4a GetTextization.Failed.PO Local Privilege Escalation Vulnerability

Bugtraq ID:	25402
Class:	Race Condition Error
CVE:	CVE-2007-4462
Remote:	No
Local:	Yes
Published:	Aug 22 2007 12:00AM
Updated:	Sep 13 2007 10:40PM
Credit:	The vendor reported this issue.
Vulnerable:	po4a po4a 0.31 po4a po4a 0.30 Gentoo Linux
Not Vulnerable:	po4a po4a 0.32

po4a GetTextization.Failed.PO Local Privilege Escalation Vulnerability

The 'po4a' utility is prone to a local privilege-escalation vulnerability because it creates a temporary file insecurely.

Attackers can leverage this issue to launch symbolic-link attacks. This may facilitate the compromise of affected computers.

Versions prior to po4a 0.32 are vulnerable.

po4a GetTextization.Failed.PO Local Privilege Escalation Vulnerability

Attackers create symbolic links in predictable locations to exploit this issue.

po4a GetTextization.Failed.PO Local Privilege Escalation Vulnerability

Solution:
The vendor released po4a 0.32 to address this issue. Please see the references for more information.


po4a po4a 0.30

• po4a po4a-0.32.tar.gz
  http://alioth.debian.org/frs/download.php/2108/po4a-0.32.tar.gz

po4a po4a 0.31

• po4a po4a-0.32.tar.gz
  http://alioth.debian.org/frs/download.php/2108/po4a-0.32.tar.gz

po4a GetTextization.Failed.PO Local Privilege Escalation Vulnerability

References:

• 0.32 Release Notes (po4a)
  
• po4a Homepage (po4a)