PDFjam Multiple Insecure Temporary File Creation Vulnerabilities

Bugtraq ID:	32931
Class:	Design Error
CVE:	CVE-2008-5743 CVE-2008-5843
Remote:	No
Local:	Yes
Published:	Dec 19 2008 12:00AM
Updated:	Apr 13 2015 09:48PM
Credit:	Reported on the openSUSE bug tracking system.
Vulnerable:	S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 S.u.S.E. openSUSE 10.1 Gentoo Linux David Firth PDFjam 1.20
Not Vulnerable:

PDFjam Multiple Insecure Temporary File Creation Vulnerabilities

Multiple PDFjam scripts create temporary files in an insecure manner.

An attacker with local access could potentially exploit these issues to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.

Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in a denial of service. Other attacks may also be possible.

PDFjam 1.20 is vulnerable; other versions may also be affected.

PDFjam Multiple Insecure Temporary File Creation Vulnerabilities

An attacker uses readily available commands to launch attacks.

PDFjam Multiple Insecure Temporary File Creation Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

PDFjam Multiple Insecure Temporary File Creation Vulnerabilities

References:

• Bug 459031 - VUL-0: [openSUSE:Factory:Contrib/pdfjam] has /tmp problems (Novell)
  
• PDFjam Homepage (David Firth)