TAU Tuning and Analysis Utilities Insecure Temporary File Creation Vulnerabilities

Bugtraq ID:	32404
Class:	Design Error
CVE:	CVE-2008-5157
Remote:	No
Local:	Yes
Published:	Aug 11 2008 12:00AM
Updated:	Nov 21 2008 11:43PM
Credit:	Dmitry E. Oboukhov
Vulnerable:	University of Oregon TAU 2.16.4
Not Vulnerable:

TAU Tuning and Analysis Utilities Insecure Temporary File Creation Vulnerabilities

TAU creates temporary files in an insecure manner.

An attacker with local access could perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.

Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in a denial of service. Other attacks may also be possible.

TAU 2.16.4 is vulnerable; other versions may also be affected.

TAU Tuning and Analysis Utilities Insecure Temporary File Creation Vulnerabilities

An attacker uses readily available commands to launch attacks.

TAU Tuning and Analysis Utilities Insecure Temporary File Creation Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

TAU Tuning and Analysis Utilities Insecure Temporary File Creation Vulnerabilities

References:

• Re: Possible mass bug filing: The possibility of attack with the help of symlink (Dmitry E. Oboukhov)
  
• TAU Homepage (University of Oregon )
  
• #506348 - CVE-2008-5157: allows local users to overwrite arbitrary files via a s (Debian)