Rhythmbox 'context' Plugin Insecure Temporary File Creation Vulnerability

Bugtraq ID:	54186
Class:	Design Error
CVE:	CVE-2012-3355
Remote:	No
Local:	Yes
Published:	Jun 25 2012 12:00AM
Updated:	Jul 11 2012 07:00PM
Credit:	Hans Spaans
Vulnerable:	Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64
Not Vulnerable:

Rhythmbox 'context' Plugin Insecure Temporary File Creation Vulnerability

Rhythmbox is prone to an insecure temporary file-creation vulnerability.

An attacker with local access could potentially exploit this issue to perform symbolic-link attacks.

Successfully mounting a symbolic attack may allow the attacker to delete or modify sensitive files. Other attacks may also be possible.

Rhythmbox 0.13.3 is vulnerable; other versions may also be affected.

Rhythmbox 'context' Plugin Insecure Temporary File Creation Vulnerability

An attacker uses readily available commands to exploit these issues.

Rhythmbox 'context' Plugin Insecure Temporary File Creation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Rhythmbox 'context' Plugin Insecure Temporary File Creation Vulnerability

References:

• Rhythmbox Homepage (GNOME)