hugin Insecure Temporary File Creation Vulnerability

Bugtraq ID:	26730
Class:	Race Condition Error
CVE:	CVE-2007-5200
Remote:	No
Local:	Yes
Published:	Dec 05 2007 12:00AM
Updated:	Dec 06 2007 06:02PM
Credit:	S.u.S.E Linux disclosed this issue.
Vulnerable:	S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 Redhat Fedora 7 hugin hugin 0.6.1 hugin hugin 0.7_beta4 Gentoo Linux
Not Vulnerable:

hugin Insecure Temporary File Creation Vulnerability

The 'hugin' program is prone to a security vulnerability because it creates temporary files in an insecure manner.

An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.

Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in a denial of service. Other attacks may also be possible.

This issue affects hugin 0.6.1 and 0.7_beta4; other versions may also be vulnerable.

hugin Insecure Temporary File Creation Vulnerability

An attacker uses readily available commands to exploit this issue.

hugin Insecure Temporary File Creation Vulnerability

Solution:
Security advisories and upgrades have been issued to address this issue. Please see the references for more information.

hugin Insecure Temporary File Creation Vulnerability

References:

• hugin Homepage (hugin)
  
• [Full-disclosure] [ GLSA 200712-01 ] Hugin: Insecure temporary file creation (Pierre-Yves Rofes )
  
• Fedora 7 Update: hugin-0.6.1-11.fc7 (Red Hat)
  
• SUSE Security Summary Report SUSE-SR:2007:020 (S.u.S.E.)