Description
Helix GNOME Updater helix-update 0.5 and earlier does not properly create /tmp directories, which allows local users to create empty system configuration files such as /etc/config.d/bashrc, /etc/config.d/csh.cshrc, and /etc/rc.config.
References
- 20000819 Multiple Local Vulnerabilities in Helix Gnome Installer mailing-list
- 1596 vdb-entry
- 20000820 [Helix Beta] Helix Code Security Advisory - Helix GNOME Installer mailing-list