Description
Globus Toolkit 3.2.x, 4.0.x, and 4.1.0 before 20060815 allow local users to obtain sensitive information (proxy certificates) and overwrite arbitrary files via a symlink attack on temporary files in the /tmp directory, as demonstrated by files created by (1) myproxy-admin-adduser, (2) grid-ca-sign, and (3) grid-security-config.
References
- [security-announce] 20060815 Temporary File Handling Vulnerability mailing-list
- ADV-2006-3290 vdb-entry
- 21516 third-party-advisory
- 19549 vdb-entry
- globus-tmp-symlink(28410) vdb-entry