Docutils 'rst.el' Insecure Temporary File Creation Vulnerability

Bugtraq ID:	37316
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Dec 12 2009 12:00AM
Updated:	Dec 14 2009 11:43PM
Credit:	Jakob Wilk
Vulnerable:	Docutils Docutils 0.6 Docutils Docutils 0.5
Not Vulnerable:

Docutils 'rst.el' Insecure Temporary File Creation Vulnerability

Docutils creates temporary files in an insecure manner.

An attacker with local access could obtain sensitive information or perform symbolic-link attacks to overwrite arbitrary files in the context of the affected application.

Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in a denial of service. Other attacks may also be possible.

Docutils 0.5 and 0.6 are vulnerable; other versions may also be affected.

Docutils 'rst.el' Insecure Temporary File Creation Vulnerability

An attacker can use readily available commands to launch attacks.

Docutils 'rst.el' Insecure Temporary File Creation Vulnerability

Solution:
Updates are available. Please see the references for details.

Docutils 'rst.el' Insecure Temporary File Creation Vulnerability

References:

• Docutils Homepage (Docutils)
  
• python-docutils: insecure use of temporary files (Jakub Wilk)