NetCitadel Firewall Builder Script Generation Insecure Temporary File Creation Vulnerability

Bugtraq ID:	36468
Class:	Design Error
CVE:	CVE-2009-4664
Remote:	No
Local:	Yes
Published:	Sep 21 2009 12:00AM
Updated:	Apr 13 2015 09:49PM
Credit:	Reported by the vendor
Vulnerable:	NetCitadel Firewall Builder 3.0.6 NetCitadel Firewall Builder 3.0.5 NetCitadel Firewall Builder 3.0.4 Gentoo Linux
Not Vulnerable:	NetCitadel Firewall Builder 3.0.7

NetCitadel Firewall Builder Script Generation Insecure Temporary File Creation Vulnerability

Firewall Builder creates temporary files in an insecure manner.

An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.

Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files or to execute arbitrary code with elevated privileges.

Firewall Builder 3.0.4, 3.0.5, and 3.0.6 are vulnerable; other versions may also be affected.

NetCitadel Firewall Builder Script Generation Insecure Temporary File Creation Vulnerability

An attacker uses readily available commands to exploit this issue.

NetCitadel Firewall Builder Script Generation Insecure Temporary File Creation Vulnerability

Solution:
Updates are available. Please see the references for more information.

NetCitadel Firewall Builder Script Generation Insecure Temporary File Creation Vulnerability

References:

• Firewall Builder (NetCitadel)
  
• Firewall Builder v3.0.7 Released (NetCitadel)