winetricks 'x_showmenu.txt' Insecure Temporary File Creation Vulnerability

Bugtraq ID:	33474
Class:	Design Error
CVE:	CVE-2009-0313
Remote:	No
Local:	Yes
Published:	Jan 27 2009 12:00AM
Updated:	Feb 18 2009 10:37PM
Credit:	Stefan Nordhausen
Vulnerable:	S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 Dan Kegel winetricks 20081217
Not Vulnerable:	Dan Kegel winetricks 20081223

winetricks 'x_showmenu.txt' Insecure Temporary File Creation Vulnerability

The 'winetricks' script creates a temporary file in an insecure manner.

An attacker with local access could perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.

Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in a denial of service. Other attacks may also be possible.

Versions prior to winetricks 20081223 are vulnerable.

winetricks 'x_showmenu.txt' Insecure Temporary File Creation Vulnerability

An attacker uses readily available commands to launch attacks.

winetricks 'x_showmenu.txt' Insecure Temporary File Creation Vulnerability

Solution:
The vendor has released an updated version; please see the references for more information.

winetricks 'x_showmenu.txt' Insecure Temporary File Creation Vulnerability

References:

• Fix symlink vulnerability pointed out by Stefan Nordhausen. (daniel.r.kegel)
  
• winetricks Homepage (Dan Kegel)