Perl Capture::Tiny 'lib/Capture/Tiny.pm' Insecure Temporary File Creation Vulnerability

Bugtraq ID:	65475
Class:	Design Error
CVE:	CVE-2014-1875
Remote:	No
Local:	Yes
Published:	Feb 06 2014 12:00AM
Updated:	Apr 16 2015 06:07PM
Credit:	Jakub Wilk
Vulnerable:
Not Vulnerable:

Perl Capture::Tiny 'lib/Capture/Tiny.pm' Insecure Temporary File Creation Vulnerability

The Capture::Tiny module for Perl is prone to insecure temporary-file-creation vulnerability because it creates temporary files in an insecure manner

An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.

Successfully mounting a symlink attack may allow the attacker to corrupt sensitive files or gain access to sensitive information. Other attacks may also be possible.

Capture::Tiny 0.23 is vulnerable; other versions may also be affected.

Perl Capture::Tiny 'lib/Capture/Tiny.pm' Insecure Temporary File Creation Vulnerability

An attacker uses readily available commands to exploit this issue.

Perl Capture::Tiny 'lib/Capture/Tiny.pm' Insecure Temporary File Creation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Perl Capture::Tiny 'lib/Capture/Tiny.pm' Insecure Temporary File Creation Vulnerability

References:

• Bug 1062424 - (CVE-2014-1875) CVE-2014-1875 perl-Capture-Tiny: insecure temporar (Red Hat Bugzilla)
  
• Capture::Tiny Product Page (David Golden)
  
• insecure use of /tmp #16 (Jakub Wilk)
  
• libcapture-tiny-perl: CVE-2014-1875: insecure use of /tmp (Debian)