Verlihub Insecure Temporary File Creation Vulnerability

Bugtraq ID:	32889
Class:	Design Error
CVE:	CVE-2008-5706
Remote:	No
Local:	Yes
Published:	Nov 21 2008 12:00AM
Updated:	Dec 30 2008 11:02PM
Credit:	v4lkyrius
Vulnerable:	Verlihub Project Verlihub 0.9.8d RC2
Not Vulnerable:

Verlihub Insecure Temporary File Creation Vulnerability

Verlihub creates temporary files in an insecure manner.

An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.

Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in a denial of service. Other attacks may also be possible.

Verlihub 0.9.8d RC2 is vulnerable; other versions may also be affected.

Verlihub Insecure Temporary File Creation Vulnerability

An attacker uses readily available commands to exploit this issue.

Verlihub Insecure Temporary File Creation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Verlihub Insecure Temporary File Creation Vulnerability

References:

• Remote command execution and the possibility of attack with the help of symlinks (Giuseppe Iuculano)
  
• Verlihub Homepage (Verlihub Project)