UniversalIndentGUI 'SettingsPaths.cpp' Insecure Temporary File Creation Vulnerability

Bugtraq ID:	33763
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Feb 13 2009 12:00AM
Updated:	Feb 13 2009 10:58PM
Credit:	This issue was disclosed by the vendor.
Vulnerable:	Thomas Schweitzer UniversalIndentGUI 1.0.1
Not Vulnerable:	Thomas Schweitzer UniversalIndentGUI 1.0.2

UniversalIndentGUI 'SettingsPaths.cpp' Insecure Temporary File Creation Vulnerability

UniversalIndentGUI creates temporary files in an insecure manner.

An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.

Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in a denial of service. Other attacks may also be possible.

Versions prior to UniversalIndentGUI 1.0.2 are vulnerable.

UniversalIndentGUI 'SettingsPaths.cpp' Insecure Temporary File Creation Vulnerability

An attacker uses readily available commands to exploit this issue.

UniversalIndentGUI 'SettingsPaths.cpp' Insecure Temporary File Creation Vulnerability

Solution:
Updates are available. Please see the references for more information.


Thomas Schweitzer UniversalIndentGUI 1.0.1

• Thomas Schweitzer universalindentgui-1.0.2.tar.gz
  http://sourceforge.net/project/showfiles.php?group_id=167482&package_i d=190449&release_id=660679

UniversalIndentGUI 'SettingsPaths.cpp' Insecure Temporary File Creation Vulnerability

References:

• revision 901, Wed Nov 12 14:12:51 2008 UTC (UniversalIndentGUI)
  
• UniversalIndentGUI Homepage (Thomas Schweitzer)