Pmake Insecure Temporary File Creation Vulnerability

Bugtraq ID:	47878
Class:	Design Error
CVE:	CVE-2011-1920
Remote:	No
Local:	Yes
Published:	May 16 2011 12:00AM
Updated:	Nov 22 2013 12:54AM
Credit:	Matej Vela
Vulnerable:	Pmake Pmake 1.111 Pmake Pmake 0 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:

Pmake Insecure Temporary File Creation Vulnerability

Pmake is prone to an insecure temporary-file-creation vulnerability.

Successfully exploiting this issue allows an attacker to overwrite arbitrary files and to perform symbolic-link attacks in the context of the affected application. Other attacks may also be possible.

Pmake Insecure Temporary File Creation Vulnerability

An attacker can use readily available commands to launch attacks.

Pmake Insecure Temporary File Creation Vulnerability

Solution:
Updates are available. Please see the references for details.

Pmake Insecure Temporary File Creation Vulnerability

References:

• Bug 705090 - pmake: Use of insecure temporary file for 'depend' target (Jan Lieskovsky)
  
• Pmake Homepage (Pmake)
  
• pmake: insecure temporary files (Matej Vela )