Login
Newsletter
Werbung

Sicherheit: Unsichere Verwendung von temporären Dateien in semi und wemi
Aktuelle Meldungen Distributionen
Name: Unsichere Verwendung von temporären Dateien in semi und wemi
ID: 200308-02
Distribution: Gentoo
Plattformen: Keine Angabe
Datum: Sa, 16. August 2003, 13:00
Referenzen: Keine Angabe
Applikationen: semi

Originalnachricht

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

--------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200308-02
--------------------------------------------------------------------

          PACKAGE : semi
          SUMMARY : insecure temporary files creation
             DATE : 2003-08-14 19:30 UTC
          EXPLOIT : local
VERSIONS AFFECTED : <semi-1.14.5-r1
    FIXED VERSION : >=semi-1.14.5-r1
              CVE : CAN-2003-0440

--------------------------------------------------------------------

quote from CVE:

"The (1) semi MIME library 1.14.5 and earlier, and (2) wemi 1.14.0 and
possibly other versions, allows local users to overwrite arbitrary files
via a symlink attack on temporary files."

SOLUTION

It is recommended that all Gentoo Linux users who are running
app-emacs/semi upgrade to semi-1.14.5-r1 as follows

emerge sync
emerge semi
emerge clean

--------------------------------------------------------------------
aliz@gentoo.org - GnuPG key is available at http://dev.gentoo.org/~aliz
usata@gentoo.org
--------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQE/O+NVfT7nyhUpoZMRAlo0AJ0ZwAWeNbss87RYJ5UaSvHXkF3n7wCfbZTw
eDaHCxhEc1WGSEoQpcL+/J8=
=ThD4
-----END PGP SIGNATURE-----
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung