AIX dtmail(1) Insecure Temporary File Creation Vulnerability

Bugtraq ID:	447
Class:	Origin Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Dec 09 1998 12:00AM
Updated:	Dec 09 1998 12:00AM
Credit:	This vulnerability was published to the IBM APAR Database on December 9, 1998. The SecurityFocus Database entry for this problem is based wholly off that information.
Vulnerable:	IBM AIX 4.3.2 IBM AIX 4.3 IBM AIX 4.2.1 IBM AIX 4.2
Not Vulnerable:	IBM AIX 4.1.5 IBM AIX 4.1.4 IBM AIX 4.1.3 IBM AIX 4.1.2 IBM AIX 4.1.1 IBM AIX 4.1

AIX dtmail(1) Insecure Temporary File Creation Vulnerability

Under some versions of AIX dtmail(1) writes out non-random files in the users home directory. These files may be symlinked to overwrite other files owned by 'mail'. This allows users to corrupt other user's mail boxes.

AIX dtmail(1) Insecure Temporary File Creation Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

AIX dtmail(1) Insecure Temporary File Creation Vulnerability

Solution:
IBM has released the following APAR'S to address this problem:

AIX 4.3
---------
APAR # IX85233

AIX 4.2
----------
APAR # IX84230

AIX dtmail(1) Insecure Temporary File Creation Vulnerability

References:

• AIX Fix Distribution Service (IBM)
  
• IBM Support Databases (IBM)