GNU LibTool Local Insecure Temporary Directory Creation Vulnerability

BID:9530

Info

GNU LibTool Local Insecure Temporary Directory Creation Vulnerability

Bugtraq ID: 9530
Class: Design Error
CVE:
Remote: No
Local: Yes
Published: Jan 30 2004 12:00AM
Updated: Jan 30 2004 12:00AM
Credit: Discovery credited to Stefan Nordhausen; additionally Joseph S. Myers independently discovered this issue.
Vulnerable: GNU libtool 1.5
+ OpenPKG OpenPKG 2.0
+ OpenPKG OpenPKG 1.3
+ OpenPKG OpenPKG 1.3
GNU libtool 1.4.3
GNU libtool 1.4.2
GNU libtool 1.4.1
GNU libtool 1.4
GNU libtool 1.3.5
GNU libtool 1.3.4
GNU libtool 1.3.3
GNU libtool 1.3.2
GNU libtool 1.3
GNU libtool 1.2
GNU libtool 1.1
GNU libtool 1.0
Not Vulnerable: GNU libtool 1.5.2

Discussion

GNU LibTool Local Insecure Temporary Directory Creation Vulnerability

A vulnerability has been identified in the creation of temporary directories by the libtool script. Because of this, an attacker may be able to corrupt arbitrary files on a system, in the context of the user invoking the script.

Exploit / POC

GNU LibTool Local Insecure Temporary Directory Creation Vulnerability

No exploit required for this vulnerability.

Solution / Fix

GNU LibTool Local Insecure Temporary Directory Creation Vulnerability

Solution:
It has been reported that this issue has been resolved in version 1.5.2 of libtool. This has not been confirmed by the maintainer or Symantec.

Conectiva has released an advisory CLA-2004:811 with fixes to address this issue. Please see the referenced advisory for more information.

OpenPKG advisory OpenPKG-SA-2004.004 was released to address this issue. Please refer to this advisory for details for obtaining and applying fixes.

Red Hat Fedora Legacy has released advisory FLSA:1268 dealing with this issue for Red Hat Linux 8.0, 7.3 and 7.2. Please see the referenced advisory for more information.


GNU libtool 1.4

GNU libtool 1.4.2

GNU libtool 1.4.3

GNU libtool 1.5

References

GNU LibTool Local Insecure Temporary Directory Creation Vulnerability

References:
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report