--nextPart3724042.qKUrx0F9RW

Content-Type: text/plain;

  charset="us-ascii"

Content-Transfer-Encoding: 7bit

Content-Disposition: inline



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Gentoo Linux Security Advisory                           GLSA 200803-26

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                                            http://security.gentoo.org/

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



  Severity: Normal

     Title: Adobe Acrobat Reader: Insecure temporary file creation

      Date: March 18, 2008

      Bugs: #212367

        ID: 200803-26



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



Synopsis

========



An insecure temporary file creation vulnerability has been discovered

in Adobe Acrobat Reader.



Background

==========



Acrobat Reader is a PDF reader released by Adobe.



Affected packages

=================



    -------------------------------------------------------------------

     Package            /  Vulnerable  /                    Unaffected

    -------------------------------------------------------------------

  1  app-text/acroread     < 8.1.2-r1                      >= 8.1.2-r1



Description

===========



SUSE reported that the "acroread" wrapper script does not create

temporary files in a secure manner when handling SSL certificates

(CVE-2008-0883).



Impact

======



A local attacker could exploit this vulnerability to overwrite

arbitrary files via a symlink attack on temporary files.



Workaround

==========



There is no known workaround at this time.



Resolution

==========



All Adobe Acrobat Reader users should upgrade to the latest version:



    # emerge --sync

    # emerge --ask --oneshot --verbose
 ">=app-text/acroread-8.1.2-r1"



References

==========



  [ 1 ] CVE-2008-0883

        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0883



Availability

============



This GLSA and any updates to it are available for viewing at

the Gentoo Security Website:



  http://security.gentoo.org/glsa/glsa-200803-26.xml



Concerns?

=========



Security is a primary focus of Gentoo Linux and ensuring the

confidentiality and security of our users machines is of utmost

importance to us. Any security concerns should be addressed to

security@gentoo.org or alternatively, you may file a bug at

http://bugs.gentoo.org.



License

=======



Copyright 2008 Gentoo Foundation, Inc; referenced text

belongs to its owner(s).



The contents of this document are licensed under the

Creative Commons - Attribution / Share Alike license.



http://creativecommons.org/licenses/by-sa/2.5



--nextPart3724042.qKUrx0F9RW

Content-Type: application/pgp-signature; name=signature.asc 

Content-Description: This is a digitally signed message part.



-----BEGIN PGP SIGNATURE-----

Version: GnuPG v2.0.7 (GNU/Linux)



iD8DBQBH4Ad8yZx3L/ph1soRAt0gAJ9A+anasAtuJX1FUsQ4V7lnSGEO5ACguRc6

AF5/QUwMA7dj/Qp4HLgVALU=

=1+EW

-----END PGP SIGNATURE-----



--nextPart3724042.qKUrx0F9RW--

-- 

gentoo-announce@lists.gentoo.org mailing list