|
|
Family: Gentoo Local Security Checks --> Category: infos
[GLSA-200506-13] webapp-config: Insecure temporary file handling Vulnerability Scan
Vulnerability Scan Summary
webapp-config: Insecure temporary file handling
Detailed Explanation for this Vulnerability Test
The remote host is affected by the vulnerability described in GLSA-200506-13
(webapp-config: Insecure temporary file handling)
Eric Romang discovered webapp-config uses a predictable temporary
filename while processing certain options, resulting in a race
condition.
Impact
Successful exploitation of the race condition would allow an
attacker to disrupt the operation of webapp-config, or execute
arbitrary shell commands with the rights of the user running
webapp-config. A local attacker could use a symlink attack to create or
overwrite files with the permissions of the user running webapp-config.
Workaround
There is no known workaround at this time.
Solution:
All webapp-config users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-www/webapp-config-1.11"
Threat Level: Medium
Click HERE for more information and discussions on this network vulnerability scan.
|
