Pen 'penctl.cgi' Multiple Insecure Temporary File Creation Vulnerabilities

Bugtraq ID:	66214
Class:	Design Error
CVE:	CVE-2014-2387
Remote:	No
Local:	Yes
Published:	Mar 13 2014 12:00AM
Updated:	Mar 21 2014 12:45AM
Credit:	Steve Kemp
Vulnerable:
Not Vulnerable:

Pen 'penctl.cgi' Multiple Insecure Temporary File Creation Vulnerabilities

Pen is prone to multiple insecure temporary-file-creation vulnerabilities because it creates temporary files in an insecure manner

An attacker with local access could potentially exploit these issues to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.

Successfully mounting a symlink attack may allow the attacker to corrupt sensitive files or gain access to sensitive information. Other attacks may also be possible.

Pen 'penctl.cgi' Multiple Insecure Temporary File Creation Vulnerabilities

An attacker uses readily available commands to exploit this issue.

Pen 'penctl.cgi' Multiple Insecure Temporary File Creation Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Pen 'penctl.cgi' Multiple Insecure Temporary File Creation Vulnerabilities

References:

• Pen Homepage (Ulric Eriksson )