Bugzilla temporary file symlink attack
| bugzilla-tmpfile-symlink (11867) |  Medium Risk |
Description:
Bugzilla creates temporary files in world or group writable directories. A local attacker could use this vulnerability to create symbolic links from these files to overwrite or create arbitrary files on the system.
Platforms Affected:
- Conectiva, Linux 9.0
- Mozilla, Bugzilla 2.10
- Mozilla, Bugzilla 2.12
- Mozilla, Bugzilla 2.14
- Mozilla, Bugzilla 2.14.1
- Mozilla, Bugzilla 2.14.2
- Mozilla, Bugzilla 2.14.3
- Mozilla, Bugzilla 2.14.4
- Mozilla, Bugzilla 2.14.5
- Mozilla, Bugzilla 2.16
- Mozilla, Bugzilla 2.16.1
- Mozilla, Bugzilla 2.16.2
- Mozilla, Bugzilla 2.17
- Mozilla, Bugzilla 2.17.1
- Mozilla, Bugzilla 2.17.3
Remedy:
Upgrade to the latest version of Bugzilla (2.16.3 or later or 2.17.4 or later), as listed in Bugzilla Bug 197153. See References.
For Conectiva Linux:
Upgrade to the latest bugzilla package, as listed below. Refer to Conectiva Linux Security Announcement CLSA-2003:653 for more information. See References.
Conectiva Linux 9: 2.16.3-29154U90_1cl or later
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
File Manipulation
References:
- BugTraq Mailing List, Fri Apr 25 2003 - 03:40:33 CDT , XSS, insecure temporary filenames at http://archives.neohapsis.com/archives/bugtraq/2003-04/0323.html.
- Bugzilla Bug 197153, potential symlink attack vulnerability in showdependancygraph.cgi and GenerateVersionTable at http://bugzilla.mozilla.org/show_bug.cgi?id=197153.
- Conectiva Linux Security Announcement CLSA-2003:653, bugzilla at http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000653.
- BID-7412: Bugzilla Insecure Temporary File Handling Vulnerabilities
- CVE-2003-0603: Bugzilla 2.16.x before 2.16.3, 2.17.x before 2.17.4, and earlier versions allows local users to overwrite arbitrary files via a symlink attack on temporary files that are created in directories with group-writable or world-writable permissions.
Reported:
Apr 25, 2003
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net