Description
LutelWall 0.97 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file created by a system call to wget.
References
- http://firewall.lutel.pl/download/0.98/ChangeLog
- GLSA-200506-10 vendor-advisory
- 1014112 vdb-entry
- 20050606 LutelWall <= 0.97 insecure temporary file creation mailing-list
- http://www.zataz.net/adviso/lutelwall-05222005.txt
- 15647 third-party-advisory
- 15665 third-party-advisory
- 13863 vdb-entry