didjvu and pdf2djvu Insecure Temporary File Creation Vulnerability
BID:74581
Info
didjvu and pdf2djvu Insecure Temporary File Creation Vulnerability
| Bugtraq ID: | 74581 |
| Class: | Design Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | May 10 2015 12:00AM |
| Updated: | May 10 2015 12:00AM |
| Credit: | Jakub Wilk |
| Vulnerable: |
Jakub Wilk pdf2djvu 0.7.20 Jakub Wilk pdf2djvu 0.7.19 Jakub Wilk pdf2djvu 0.7.18 Jakub Wilk didjvu 0.2.9 Jakub Wilk didjvu 0.2.8 Jakub Wilk didjvu 0.2.7 Jakub Wilk didjvu 0.2.6 Jakub Wilk didjvu 0.2.5 Jakub Wilk didjvu 0.3 Jakub Wilk didjvu 0.2 |
| Not Vulnerable: |
Jakub Wilk pdf2djvu 0.7.21 Jakub Wilk didjvu 0.4 |
Discussion
didjvu and pdf2djvu Insecure Temporary File Creation Vulnerability
didjvu and pdf2djvu are prone to a vulnerability because they create temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application. Other attacks may also be possible.
didjvu and pdf2djvu are prone to a vulnerability because they create temporary files in an insecure manner.
An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application. Other attacks may also be possible.
Exploit / POC
didjvu and pdf2djvu Insecure Temporary File Creation Vulnerability
An attacker can use readily available commands to exploit this issue.
An attacker can use readily available commands to exploit this issue.
Solution / Fix
didjvu and pdf2djvu Insecure Temporary File Creation Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.