Lucene search

Gentoo FoundationGLSA-201208-05

HistoryAug 14, 2012 - 12:00 a.m.

Perl Config-IniFiles Module: Insecure temporary file usage

2012-08-1400:00:00

Gentoo Foundation

security.gentoo.org

CVSS2

3.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:P/A:P

EPSS

Percentile

5.1%

JSON

Background

Config-IniFiles is a Perl module for reading .ini-style configuration files.

Description

The Perl Config-IniFiles module uses predicatable temporary file names.

Impact

A local attacker could perform symlink attacks to overwrite arbitrary files with the privileges of the user running the application.

Workaround

There is no known workaround at this time.

Resolution

All users of the Perl Config-IniFiles module should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose
 "&gt;=dev-perl/Config-IniFiles-2.710.0"

OSVersionArchitecturePackageVersionFilename
Gentooanyalldev-perl/config-inifiles< 2.710.0UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Gentoo	any	all	dev-perl/config-inifiles	< 2.710.0	UNKNOWN

CVSS2

3.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:P/A:P

EPSS

Percentile

5.1%

JSON

Related for GLSA-201208-05