Description
The (1) write_list and (2) dump_curr_list functions in Net-Acct before 0.71 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | net-acct | 0.71-7 | — |
| Debian 12 | net-acct | 0.71-7 | — |
| Debian 3.0 | net-acct | 0.71-5woody1 | DSA-559-1 |
Advisories 1
- DSA-559-1 net-acct - insecure temporary file Debian Security (DSA / DLA) · Mar 9, 2026
References
- net-acct-tmp-symlink(17283) vdb-entry
- 12476 third-party-advisory
- DSA-559 vendor-advisory
- 20040908 Insecure Temporary File Creation Vulnerability in Net-Acct mailing-list
- 11125 vdb-entry
- http://exorsus.net/projects/net-acct/net-acct-notempfiles.patch