Description
ncompress 4.2.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files using (1) zdiff or (2) zcmp, a different vulnerability than CVE-2004-0970.
References
- 12 third-party-advisory
- 20050916 ncompress insecure temporary file creation mailing-list
- 20050916 ncompress insecure temporary file creation mailing-list
- http://www.zataz.net/adviso/ncompress-09052005.txt