SaltStack Salt CVE-2013-4437 Insecure Temporary File Handling Vulnerability
BID:63242
Info
SaltStack Salt CVE-2013-4437 Insecure Temporary File Handling Vulnerability
| Bugtraq ID: | 63242 |
| Class: | Design Error |
| CVE: |
CVE-2013-4437 |
| Remote: | No |
| Local: | Yes |
| Published: | Oct 16 2013 12:00AM |
| Updated: | Apr 13 2015 10:16PM |
| Credit: | Michael Scherer of Red Hat |
| Vulnerable: |
SaltStack Salt 0.17.0 |
| Not Vulnerable: |
SaltStack Salt 0.17.1 |
Discussion
SaltStack Salt CVE-2013-4437 Insecure Temporary File Handling Vulnerability
Salt is prone to an insecure temporary file-handling vulnerability.
An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.
Salt is prone to an insecure temporary file-handling vulnerability.
An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.
Exploit / POC
SaltStack Salt CVE-2013-4437 Insecure Temporary File Handling Vulnerability
An attacker can use readily available commands to exploit this issue.
An attacker can use readily available commands to exploit this issue.
Solution / Fix
SaltStack Salt CVE-2013-4437 Insecure Temporary File Handling Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
SaltStack Salt CVE-2013-4437 Insecure Temporary File Handling Vulnerability
References:
References:
- Re: CVE request for saltstack minion identity usurpation (Kurt Seifried)
- Salt 0.17.1 Release Notes (SaltStack)
- SaltStack Homepage (SaltStack)