X-CD-Roast Local Insecure File Creation Symlink Vulnerability
BID:8983
Info
X-CD-Roast Local Insecure File Creation Symlink Vulnerability
| Bugtraq ID: | 8983 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 04 2003 12:00AM |
| Updated: | Nov 04 2003 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to Stefan Nordhausen <[email protected]>. |
| Vulnerable: |
X-CD-Roast X-CD-Roast 0.98 alpha14 X-CD-Roast X-CD-Roast 0.98 alpha13 X-CD-Roast X-CD-Roast 0.98 alpha12 X-CD-Roast X-CD-Roast 0.98 alpha11 X-CD-Roast X-CD-Roast 0.98 alpha10 |
| Not Vulnerable: |
X-CD-Roast X-CD-Roast 0.98 alpha15 |
Discussion
X-CD-Roast Local Insecure File Creation Symlink Vulnerability
X-CD-Roast has been reported prone to an insecure file creation vulnerability that may be exploited to corrupt arbitrary files. The issue has been reported to present itself because X-CD-Roast will follow symbolic links when writing specific files. The problem is also conjectured to be exaggerated as a result of a lack of sufficient access controls set by X-CD-Roast on the files that it creates and employs.
A local user may leverage this condition to corrupt arbitrary files triggering a system wide denial of service or potentially elevating their system privileges.
X-CD-Roast has been reported prone to an insecure file creation vulnerability that may be exploited to corrupt arbitrary files. The issue has been reported to present itself because X-CD-Roast will follow symbolic links when writing specific files. The problem is also conjectured to be exaggerated as a result of a lack of sufficient access controls set by X-CD-Roast on the files that it creates and employs.
A local user may leverage this condition to corrupt arbitrary files triggering a system wide denial of service or potentially elevating their system privileges.
Exploit / POC
X-CD-Roast Local Insecure File Creation Symlink Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
X-CD-Roast Local Insecure File Creation Symlink Vulnerability
Solution:
The vendor has released an update to address this issue:
X-CD-Roast X-CD-Roast 0.98 alpha12
X-CD-Roast X-CD-Roast 0.98 alpha10
X-CD-Roast X-CD-Roast 0.98 alpha14
X-CD-Roast X-CD-Roast 0.98 alpha11
X-CD-Roast X-CD-Roast 0.98 alpha13
Solution:
The vendor has released an update to address this issue:
X-CD-Roast X-CD-Roast 0.98 alpha12
-
X-CD-Roast xcdroast-0.98alpha15.tar.gz
http://prdownloads.sourceforge.net/xcdroast/xcdroast-0.98alpha15.tar.g z
X-CD-Roast X-CD-Roast 0.98 alpha10
-
X-CD-Roast xcdroast-0.98alpha15.tar.gz
http://prdownloads.sourceforge.net/xcdroast/xcdroast-0.98alpha15.tar.g z
X-CD-Roast X-CD-Roast 0.98 alpha14
-
X-CD-Roast xcdroast-0.98alpha15.tar.gz
http://prdownloads.sourceforge.net/xcdroast/xcdroast-0.98alpha15.tar.g z
X-CD-Roast X-CD-Roast 0.98 alpha11
-
X-CD-Roast xcdroast-0.98alpha15.tar.gz
http://prdownloads.sourceforge.net/xcdroast/xcdroast-0.98alpha15.tar.g z
X-CD-Roast X-CD-Roast 0.98 alpha13
-
X-CD-Roast xcdroast-0.98alpha15.tar.gz
http://prdownloads.sourceforge.net/xcdroast/xcdroast-0.98alpha15.tar.g z
References
X-CD-Roast Local Insecure File Creation Symlink Vulnerability
References:
References:
- X-CD-Roast Homepage (X-CD-Roast)