Description
makewhatis in the man package before 1.5i2 allows an attacker in group man to overwrite arbitrary files via a man page whose name contains shell metacharacters.
References
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=41805
- 20010611 man 1.5h10 + man 1.5i-4 exploits mailing-list
- RHSA-2001:072 vendor-advisory