Coccinelle Insecure Temporary File Creation Vulnerability

Bugtraq ID:	34848
Class:	Race Condition Error
CVE:	CVE-2009-1753
Remote:	No
Local:	Yes
Published:	May 06 2009 12:00AM
Updated:	Apr 13 2015 10:21PM
Credit:	Steffen Joeris
Vulnerable:	Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 coccinelle coccinelle 0.1.6
Not Vulnerable:	coccinelle coccinelle 0.1.7

Coccinelle Insecure Temporary File Creation Vulnerability

Coccinelle creates temporary files in an insecure manner.

An attacker with local access could potentially exploit this issue to perform symbolic link attacks to overwrite arbitrary attacker-specified files.

Versions prior to Coccinelle 0.1.7 are vulnerable.

Coccinelle Insecure Temporary File Creation Vulnerability

An attacker uses readily available commands to exploit the issue.

Coccinelle Insecure Temporary File Creation Vulnerability

Solution:
The vendor has released an update. Please see the references for details.

Coccinelle Insecure Temporary File Creation Vulnerability

References:

• Resolved issue with database backup/restore (DirectAdmin)
  
• Vendor Hompage (Coccinelle)