Dan Mueth ScrollKeeper Tempfile Symbolic Link Vulnerability

Bugtraq ID:	5602
Class:	Design Error
CVE:	CVE-2002-0662
Remote:	No
Local:	Yes
Published:	Sep 02 2002 12:00AM
Updated:	Jul 11 2009 03:56PM
Credit:	Reported by Spybreak <[email protected]>.
Vulnerable:	Dan Mueth ScrollKeeper 0.3.11 + Redhat Linux 7.3 i386 Dan Mueth ScrollKeeper 0.3.6 + Debian Linux 3.0 Dan Mueth ScrollKeeper 0.3.5 Dan Mueth ScrollKeeper 0.3.4 Dan Mueth ScrollKeeper 0.3.1 - Redhat Linux 7.3 i386 Dan Mueth ScrollKeeper 0.3 - Redhat Linux 7.3 i386
Not Vulnerable:

Dan Mueth ScrollKeeper Tempfile Symbolic Link Vulnerability

Dan Mueth ScrollKeeper is a documentation cataloging system that acts as a middle layer between applications and help browsers.

When ScrollKeeper aware browsers make a call to get a category tree, the list is passed through tempfiles with the permissions of the current user. ScrollKeeper will follow symbolic links when creating these files, potentially allowing an attacker to overwrite files with the permissions of the current user.

Dan Mueth ScrollKeeper Tempfile Symbolic Link Vulnerability

There is no exploit code necessary. An attacker would simply have to replace a ScrollKeeper tempfile with a symbolic link to a file to be overwritten.

Dan Mueth ScrollKeeper Tempfile Symbolic Link Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Debian has released fixes for this issue. Links to the fixes can be found in Debian advisory DSA 160-1 in the references section.

Gentoo Linux users are advised to update systems using the following steps:
emerge rsync
emerge scrollkeeper
emerge clean

Red Hat has released an update that prevents ScrollKeeper from following symbolic links:


Dan Mueth ScrollKeeper 0.3

• Debian scrollkeeper_0.3.6-3.1.dsc
  http://security.debian.org/pool/updates/main/s/scrollkeeper/scrollkeep er_0.3.6-3.1.dsc


• Red Hat scrollkeeper-0.3.4-5.i386.rpm
  ftp://updates.redhat.com/7.3/en/os/i386/scrollkeeper-0.3.4-5.i386.rpm


• Red Hat scrollkeeper-0.3.4-5.src.rpm
  Source RPM for Red Hat 7.3
  ftp://updates.redhat.com/7.3/en/os/SRPMS/scrollkeeper-0.3.4-5.src.rpm

Dan Mueth ScrollKeeper 0.3.1

• Debian libscrollkeeper-dev_0.3.6-3.1_alpha.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/libscrollk eeper-dev_0.3.6-3.1_alpha.deb


• Debian libscrollkeeper-dev_0.3.6-3.1_arm.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/libscrollk eeper-dev_0.3.6-3.1_arm.deb


• Debian libscrollkeeper-dev_0.3.6-3.1_i386.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/libscrollk eeper-dev_0.3.6-3.1_i386.deb


• Debian libscrollkeeper0_0.3.6-3.1_alpha.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/libscrollk eeper0_0.3.6-3.1_alpha.deb


• Debian libscrollkeeper0_0.3.6-3.1_arm.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/libscrollk eeper0_0.3.6-3.1_arm.deb


• Debian libscrollkeeper0_0.3.6-3.1_i386.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/libscrollk eeper0_0.3.6-3.1_i386.deb


• Debian libscrollkeeper0_0.3.6-3.1_mips.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/libscrollk eeper0_0.3.6-3.1_mips.deb


• Debian scrollkeeper_0.3.6-3.1.diff.gz
  http://security.debian.org/pool/updates/main/s/scrollkeeper/scrollkeep er_0.3.6-3.1.diff.gz


• Debian scrollkeeper_0.3.6-3.1.dsc
  http://security.debian.org/pool/updates/main/s/scrollkeeper/scrollkeep er_0.3.6-3.1.dsc


• Debian scrollkeeper_0.3.6-3.1_alpha.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/scrollkeep er_0.3.6-3.1_alpha.deb


• Debian scrollkeeper_0.3.6-3.1_arm.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/scrollkeep er_0.3.6-3.1_arm.deb


• Debian scrollkeeper_0.3.6-3.1_i386.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/scrollkeep er_0.3.6-3.1_i386.deb


• Debian scrollkeeper_0.3.6-3.1_ia64.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/scrollkeep er_0.3.6-3.1_ia64.deb


• Debian scrollkeeper_0.3.6-3.1_mips.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/scrollkeep er_0.3.6-3.1_mips.deb


• Red Hat scrollkeeper-0.3.4-5.i386.rpm
  ftp://updates.redhat.com/7.3/en/os/i386/scrollkeeper-0.3.4-5.i386.rpm


• Red Hat scrollkeeper-0.3.4-5.src.rpm
  Source RPM for Red Hat 7.3
  ftp://updates.redhat.com/7.3/en/os/SRPMS/scrollkeeper-0.3.4-5.src.rpm

Dan Mueth ScrollKeeper 0.3.11

• Debian scrollkeeper_0.3.6-3.1.diff.gz
  http://security.debian.org/pool/updates/main/s/scrollkeeper/scrollkeep er_0.3.6-3.1.diff.gz


• Debian scrollkeeper_0.3.6-3.1.dsc
  http://security.debian.org/pool/updates/main/s/scrollkeeper/scrollkeep er_0.3.6-3.1.dsc


• Red Hat scrollkeeper-0.3.4-5.i386.rpm
  ftp://updates.redhat.com/7.3/en/os/i386/scrollkeeper-0.3.4-5.i386.rpm


• Red Hat scrollkeeper-0.3.4-5.src.rpm
  Source RPM for Red Hat 7.3
  ftp://updates.redhat.com/7.3/en/os/SRPMS/scrollkeeper-0.3.4-5.src.rpm

Dan Mueth ScrollKeeper 0.3.4

• Red Hat scrollkeeper-0.3.4-5.i386.rpm
  ftp://updates.redhat.com/7.3/en/os/i386/scrollkeeper-0.3.4-5.i386.rpm


• Red Hat scrollkeeper-0.3.4-5.src.rpm
  Source RPM for Red Hat 7.3
  ftp://updates.redhat.com/7.3/en/os/SRPMS/scrollkeeper-0.3.4-5.src.rpm

Dan Mueth ScrollKeeper 0.3.5

• Red Hat scrollkeeper-0.3.4-5.i386.rpm
  ftp://updates.redhat.com/7.3/en/os/i386/scrollkeeper-0.3.4-5.i386.rpm


• Red Hat scrollkeeper-0.3.4-5.src.rpm
  Source RPM for Red Hat 7.3
  ftp://updates.redhat.com/7.3/en/os/SRPMS/scrollkeeper-0.3.4-5.src.rpm

Dan Mueth ScrollKeeper 0.3.6

• Debian libscrollkeeper-dev_0.3.6-3.1_alpha.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/libscrollk eeper-dev_0.3.6-3.1_alpha.deb


• Debian libscrollkeeper-dev_0.3.6-3.1_arm.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/libscrollk eeper-dev_0.3.6-3.1_arm.deb


• Debian libscrollkeeper-dev_0.3.6-3.1_i386.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/libscrollk eeper-dev_0.3.6-3.1_i386.deb


• Debian libscrollkeeper0_0.3.6-3.1_alpha.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/libscrollk eeper0_0.3.6-3.1_alpha.deb


• Debian libscrollkeeper0_0.3.6-3.1_arm.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/libscrollk eeper0_0.3.6-3.1_arm.deb


• Debian libscrollkeeper0_0.3.6-3.1_i386.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/libscrollk eeper0_0.3.6-3.1_i386.deb


• Debian libscrollkeeper0_0.3.6-3.1_mips.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/libscrollk eeper0_0.3.6-3.1_mips.deb


• Debian scrollkeeper_0.3.6-3.1.diff.gz
  http://security.debian.org/pool/updates/main/s/scrollkeeper/scrollkeep er_0.3.6-3.1.diff.gz


• Debian scrollkeeper_0.3.6-3.1.dsc
  http://security.debian.org/pool/updates/main/s/scrollkeeper/scrollkeep er_0.3.6-3.1.dsc


• Debian scrollkeeper_0.3.6-3.1_alpha.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/scrollkeep er_0.3.6-3.1_alpha.deb


• Debian scrollkeeper_0.3.6-3.1_arm.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/scrollkeep er_0.3.6-3.1_arm.deb


• Debian scrollkeeper_0.3.6-3.1_i386.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/scrollkeep er_0.3.6-3.1_i386.deb


• Debian scrollkeeper_0.3.6-3.1_ia64.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/scrollkeep er_0.3.6-3.1_ia64.deb


• Debian scrollkeeper_0.3.6-3.1_mips.deb
  http://security.debian.org/pool/updates/main/s/scrollkeeper/scrollkeep er_0.3.6-3.1_mips.deb


• Debian scrollkeeper_0.3.6.orig.tar.gz
  http://security.debian.org/pool/updates/main/s/scrollkeeper/scrollkeep er_0.3.6.orig.tar.gz

Dan Mueth ScrollKeeper Tempfile Symbolic Link Vulnerability

References: