libproc-processtable-perl '/tmp/TTYDEVS' Insecure Temporary File Creation Vulnerability

Bugtraq ID:	50868
Class:	Design Error
CVE:	CVE-2011-4363
Remote:	No
Local:	Yes
Published:	Nov 30 2011 12:00AM
Updated:	Apr 13 2015 09:28PM
Credit:	Ansgar Burchardt
Vulnerable:	Mandriva Business Server 1 X86 64 Mandriva Business Server 1 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 CPAN libproc-processtable-perl 0.45-1
Not Vulnerable:

libproc-processtable-perl '/tmp/TTYDEVS' Insecure Temporary File Creation Vulnerability

libproc-processtable-perl is prone to a vulnerability because it creates temporary files in an insecure manner.

Successfully mounting a symlink attack may allow the attacker to corrupt sensitive files or gain access to sensitive information. Other attacks may also be possible.

libproc-processtable-perl 0.45-1 is vulnerable; other versions may also be affected.

libproc-processtable-perl '/tmp/TTYDEVS' Insecure Temporary File Creation Vulnerability

An attacker can use readily available commands to exploit this issue.

libproc-processtable-perl '/tmp/TTYDEVS' Insecure Temporary File Creation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].


Mandriva Business Server 1 X86 64

• Mandriva perl-Proc-ProcessTable-0.480.0-1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva perl-Proc-ProcessTable-0.48-0.1mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/

MandrakeSoft Enterprise Server 5

• Mandriva perl-Proc-ProcessTable-0.48-0.1mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/

libproc-processtable-perl '/tmp/TTYDEVS' Insecure Temporary File Creation Vulnerability

References:

• libproc-processtable-perl Homepage (Cpan)
  
• Debian Bug report logs - #650500 unsafe use of /tmp (Ansgar Burchardt)