emesene '/tmp/emsnpic' Insecure Temporary File Creation Vulnerability

Bugtraq ID:	40455
Class:	Design Error
CVE:	CVE-2010-2053
Remote:	No
Local:	Yes
Published:	May 25 2010 12:00AM
Updated:	Apr 13 2015 09:41PM
Credit:	Emilio Pozuelo Monfort
Vulnerable:	emesene emesene 1.6.1
Not Vulnerable:	emesene emesene 1.6.2

emesene '/tmp/emsnpic' Insecure Temporary File Creation Vulnerability

emesene creates temporary files in an insecure manner.

An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.

Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in a denial of service. Other attacks may also be possible.

emesene 1.6.1 is vulnerable; other versions may also be affected.

emesene '/tmp/emsnpic' Insecure Temporary File Creation Vulnerability

An attacker can use readily available commands to exploit this issue.

emesene '/tmp/emsnpic' Insecure Temporary File Creation Vulnerability

Solution:
Updates are available. Please see the references for more details.

emesene '/tmp/emsnpic' Insecure Temporary File Creation Vulnerability

References:

• Topic: emesene 1.6.2 - "chimarrão" has been released! (emesene)
  
• emesene Download Page (emesene)
  
• emesene preditable temporary filename (gmane.org)