Debian 'apt' Package CVE-2014-7206 Insecure Temporary File Creation Vulnerability

Bugtraq ID:	70310
Class:	Design Error
CVE:	CVE-2014-7206
Remote:	No
Local:	Yes
Published:	Oct 02 2014 12:00AM
Updated:	Oct 10 2014 12:59AM
Credit:	Guillem Jover
Vulnerable:	Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

Debian 'apt' Package CVE-2014-7206 Insecure Temporary File Creation Vulnerability

Debian 'apt' package is prone to an insecure temporary file-creation vulnerability.

An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application. Other attacks may also be possible.

Debian 'apt' Package CVE-2014-7206 Insecure Temporary File Creation Vulnerability

An attacker uses readily available commands to exploit this issue.

Debian 'apt' Package CVE-2014-7206 Insecure Temporary File Creation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Debian 'apt' Package CVE-2014-7206 Insecure Temporary File Creation Vulnerability

References: