Sun OpenSolaris 'conv_lpd' Insecure Temporary File Handling Vulnerability
BID:33396
Info
Sun OpenSolaris 'conv_lpd' Insecure Temporary File Handling Vulnerability
| Bugtraq ID: | 33396 |
| Class: | Design Error |
| CVE: |
CVE-2008-5909 |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 21 2009 12:00AM |
| Updated: | Jan 21 2009 11:12PM |
| Credit: | Mike Gerdts |
| Vulnerable: |
Sun OpenSolaris build snv_99 Sun OpenSolaris build snv_96 Sun OpenSolaris build snv_95 Sun OpenSolaris build snv_92 Sun OpenSolaris build snv_91 Sun OpenSolaris build snv_90 Sun OpenSolaris build snv_89 Sun OpenSolaris build snv_88 Sun OpenSolaris build snv_87 Sun OpenSolaris build snv_85 Sun OpenSolaris build snv_84 Sun OpenSolaris build snv_83 Sun OpenSolaris build snv_82 Sun OpenSolaris build snv_80 Sun OpenSolaris build snv_78 Sun OpenSolaris build snv_77 Sun OpenSolaris build snv_76 Sun OpenSolaris build snv_68 Sun OpenSolaris build snv_67 Sun OpenSolaris build snv_64 Sun OpenSolaris build snv_61 Sun OpenSolaris build snv_59 Sun OpenSolaris build snv_57 Sun OpenSolaris build snv_50 Sun OpenSolaris build snv_39 Sun OpenSolaris build snv_36 Sun OpenSolaris build snv_29 Sun OpenSolaris build snv_22 Sun OpenSolaris build snv_19 Sun OpenSolaris build snv_13 Sun OpenSolaris build snv_107 Sun OpenSolaris build snv_106 Sun OpenSolaris build snv_105 Sun OpenSolaris build snv_104 Sun OpenSolaris build snv_104 Sun OpenSolaris build snv_103 Sun OpenSolaris build snv_102 Sun OpenSolaris build snv_101 Sun OpenSolaris build snv_100 Sun OpenSolaris build snv_02 Sun OpenSolaris build snv_01 Sun OpenSolaris 0 |
| Not Vulnerable: | |
Discussion
Sun OpenSolaris 'conv_lpd' Insecure Temporary File Handling Vulnerability
Sun OpenSolaris handles temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.
Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in privilege escalation or cause a denial-of-service condition. Other attacks may also be possible.
This issue is associated with OpenSolaris Bug ID 6655641 and an additional, unspecified internal bug.
Sun OpenSolaris handles temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.
Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in privilege escalation or cause a denial-of-service condition. Other attacks may also be possible.
This issue is associated with OpenSolaris Bug ID 6655641 and an additional, unspecified internal bug.
Exploit / POC
Sun OpenSolaris 'conv_lpd' Insecure Temporary File Handling Vulnerability
An attacker uses readily available commands to exploit this issue.
An attacker uses readily available commands to exploit this issue.
Solution / Fix
Sun OpenSolaris 'conv_lpd' Insecure Temporary File Handling Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Sun OpenSolaris 'conv_lpd' Insecure Temporary File Handling Vulnerability
References:
References: