Description
Joe text editor follows symbolic links when creating a rescue copy called DEADJOE during an abnormal exit, which allows local users to overwrite the files of other users whose joe session crashes.
References
- 20001121 Immunix OS Security update for joe mailing-list
- MDKSA-2000:072 vendor-advisory
- joe-symlink-corruption(5546) vdb-entry
- RHSA-2000:110 vendor-advisory
- CLA-2000:356 vendor-advisory
- 20001116 Joe's Own Editor File Link Vulnerability mailing-list
- 20001201 DSA-003-1 joe: symlink attack vendor-advisory
- 1959 vdb-entry