Zarafa Collaboration Platform CVE-2015-3436 Insecure Temporary File Handling Vulnerability

Bugtraq ID:	75104
Class:	Design Error
CVE:	CVE-2015-3436
Remote:	No
Local:	Yes
Published:	Jun 10 2015 12:00AM
Updated:	Jun 10 2015 12:00AM
Credit:	Suyi Guo
Vulnerable:	Zarafa Zarafa Collaboration Platform 7.1.10 Zarafa Zarafa Collaboration Platform 7.1.9 Zarafa Zarafa Collaboration Platform 7.1.8 Zarafa Zarafa Collaboration Platform 7.0.13 Zarafa Zarafa Collaboration Platform 7.0.9 Zarafa Zarafa Collaboration Platform 7.0.8 Zarafa Zarafa Collaboration Platform 7.0.7 Zarafa Zarafa Collaboration Platform 7.2.0 Zarafa Zarafa Collaboration Platform 7.1.8 beta2 Zarafa Zarafa Collaboration Platform 7.1.7 Zarafa Zarafa Collaboration Platform 7.1.6 Zarafa Zarafa Collaboration Platform 7.1.5 Zarafa Zarafa Collaboration Platform 7.1.4 Zarafa Zarafa Collaboration Platform 7.1.3 Zarafa Zarafa Collaboration Platform 7.1.2 Zarafa Zarafa Collaboration Platform 7.1.11 Zarafa Zarafa Collaboration Platform 7.1.1 Zarafa Zarafa Collaboration Platform 7.1.0 Zarafa Zarafa Collaboration Platform 7.0.6 Zarafa Zarafa Collaboration Platform 7.0.5 Zarafa Zarafa Collaboration Platform 7.0.4 Zarafa Zarafa Collaboration Platform 7.0.3 Zarafa Zarafa Collaboration Platform 7.0.2 Zarafa Zarafa Collaboration Platform 7.0.12 Zarafa Zarafa Collaboration Platform 7.0.11 Zarafa Zarafa Collaboration Platform 7.0.10 Zarafa Zarafa Collaboration Platform 7.0.1 Zarafa Zarafa Collaboration Platform 7.0.0
Not Vulnerable:	Zarafa Zarafa Collaboration Platform 7.2.1 Zarafa Zarafa Collaboration Platform 7.1.13

Zarafa Collaboration Platform CVE-2015-3436 Insecure Temporary File Handling Vulnerability

Zarafa Collaboration Platform is prone to an insecure temporary file-handling vulnerability.

An attacker with local access could potentially exploit this issue to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application.

Zarafa Collaboration Platform CVE-2015-3436 Insecure Temporary File Handling Vulnerability

An attacker can use readily available commands to exploit this issue.

Zarafa Collaboration Platform CVE-2015-3436 Insecure Temporary File Handling Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Zarafa Collaboration Platform CVE-2015-3436 Insecure Temporary File Handling Vulnerability

References:

• CVE-2015-3436 - overwrite arbitrary files in filesystem (Zarafa)
  
• Zarafa Homepage (Zarafa)
  
• FEDORA-2015-8479 (Fedora)
  
• FEDORA-2015-8487 (Fedora)