Description
plaiter in Plait before 1.6 allows local users to overwrite arbitrary files via a symlink attack on (1) cut.$$, (2) head.$$, (3) awk.$$, and (4) ps.$$ temporary files in /tmp/.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | plait | 1.5.2-2 | — |
| Debian 13 | plait | 1.5.2-2 | — |
References
- plait-file-symlink(44786) vdb-entry
- [oss-security] 20081030 CVE requests: tempfile issues for aview, mgetty, openoffice, crossfire mailing-list
- https://bugs.gentoo.org/show_bug.cgi?id=235770
- http://dev.gentoo.org/~rbu/security/debiantemp/plait
- 31617 third-party-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496381
- 30928 vdb-entry
- http://sourceforge.net/project/shownotes.php?group_id=147849&release_id=623154