Description
Tools/faqwiz/move-faqwiz.sh (aka the generic FAQ wizard moving tool) in Python 2.4.5 might allow local users to overwrite arbitrary files via a symlink attack on a tmp$RANDOM.tmp temporary file. NOTE: there may not be common usage scenarios in which tmp$RANDOM.tmp is located in an untrusted directory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | python-defaults | No fix yet | — |
References
- 4274 third-party-advisory
- 31184 vdb-entry
- python-movefaqwiz-symlink(45161) vdb-entry
- 1020904 vdb-entry
- ADV-2008-2659 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=462326
- [oss-security] 20080916 Re: CVE Request (python) mailing-list
- [oss-security] 20080915 CVE Request (python) mailing-list
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=498899