LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Advisory Watch: August 15th, 2014
Linux Advisory Watch: August 8th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Mandriva: Updated groff packages fix temporary file vulnerabilities Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Mandrake The Trustix Secure Linux team discovered a vulnerability in the groffer utility, part of the groff package. It created a temporary directory in an insecure way which allowed for the exploitation of a race condition to create or overwrite files the privileges of the user invoking groffer.
 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2006:038
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : groff
 Date    : February 8, 2006
 Affected: 10.1, 10.2, 2006.0, Corporate 3.0
 _______________________________________________________________________
 
 Problem Description:
 
 The Trustix Secure Linux team discovered a vulnerability in the groffer
 utility, part of the groff package.  It created a temporary directory
 in an insecure way which allowed for the exploitation of a race
 condition to create or overwrite files the privileges of the user
 invoking groffer.
 
 Likewise, similar temporary file issues were fixed in the pic2graph
 and eqn2graph programs which now use mktemp to create temporary
 files, as discovered by Javier Fernandez-Sanguino Pena.
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0969
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 10.1:
 2da61d56e608da8cdecd8dcaefa5a608  10.1/RPMS/groff-1.19-6.1.101mdk.i586.rpm
 b224b02a6d026ff2d6800c171731c9eb  10.1/RPMS/groff-for-man-1.19-6.1.101mdk.i586.rpm
 ccd5222ec22c3413544f4b1a27262cf6  10.1/RPMS/groff-gxditview-1.19-6.1.101mdk.i586.rpm
 23814a0830723e7c4ed5fced5995b071  10.1/RPMS/groff-perl-1.19-6.1.101mdk.i586.rpm
 d3b1d5792f5f9eb941b0a0111a5488b8  10.1/SRPMS/groff-1.19-6.1.101mdk.src.rpm

 Mandriva Linux 10.1/X86_64:
 f8a2eec5b2d92413a599f63ea9b0c180  x86_64/10.1/RPMS/groff-1.19-6.1.101mdk.x86_64.rpm
 36d3ac889a34af4274dbf966647390fb  x86_64/10.1/RPMS/groff-for-man-1.19-6.1.101mdk.x86_64.rpm
 d56f7aa42108ea4ff6375714b125e443  x86_64/10.1/RPMS/groff-gxditview-1.19-6.1.101mdk.x86_64.rpm
 027479132bfcfc79663f2d4e737f420e  x86_64/10.1/RPMS/groff-perl-1.19-6.1.101mdk.x86_64.rpm
 d3b1d5792f5f9eb941b0a0111a5488b8  x86_64/10.1/SRPMS/groff-1.19-6.1.101mdk.src.rpm

 Mandriva Linux 10.2:
 9d2bf8589987d6cb7c35ad12df82c69a  10.2/RPMS/groff-1.19-9.1.102mdk.i586.rpm
 2737744582fe03aa752d69bbbe72e8af  10.2/RPMS/groff-for-man-1.19-9.1.102mdk.i586.rpm
 f1b10bbbaeb2a0c6310b155168fcf836  10.2/RPMS/groff-gxditview-1.19-9.1.102mdk.i586.rpm
 6ebe47194102d0700c902030e9e73638  10.2/RPMS/groff-perl-1.19-9.1.102mdk.i586.rpm
 88d91b5a36400352de2cd845a5c16508  10.2/SRPMS/groff-1.19-9.1.102mdk.src.rpm

 Mandriva Linux 10.2/X86_64:
 e274e9135c59de46ee6b81e9173ae564  x86_64/10.2/RPMS/groff-1.19-9.1.102mdk.x86_64.rpm
 82320dc08ec42570eaaf7fa172d6b80a  x86_64/10.2/RPMS/groff-for-man-1.19-9.1.102mdk.x86_64.rpm
 fa52ea5b60cbe0fdc2c3995003fbd63a  x86_64/10.2/RPMS/groff-gxditview-1.19-9.1.102mdk.x86_64.rpm
 959423c66c0ae1aeecf56f38176f458c  x86_64/10.2/RPMS/groff-perl-1.19-9.1.102mdk.x86_64.rpm
 88d91b5a36400352de2cd845a5c16508  x86_64/10.2/SRPMS/groff-1.19-9.1.102mdk.src.rpm

 Mandriva Linux 2006.0:
 2bfa7438040cfdfab92d3d109afa96aa  2006.0/RPMS/groff-1.19.1-1.1.20060mdk.i586.rpm
 c408fa608c4234405b91f4cf763b1bd3  2006.0/RPMS/groff-for-man-1.19.1-1.1.20060mdk.i586.rpm
 f8e94b09822328151af0aaf213b043a9  2006.0/RPMS/groff-gxditview-1.19.1-1.1.20060mdk.i586.rpm
 c64dc660b7a906d9003205caaeabcd62  2006.0/RPMS/groff-perl-1.19.1-1.1.20060mdk.i586.rpm
 2821299644c84404e2fa743835722dab  2006.0/SRPMS/groff-1.19.1-1.1.20060mdk.src.rpm

 Mandriva Linux 2006.0/X86_64:
 63175fa1b86871cf684d768f08837ec6  x86_64/2006.0/RPMS/groff-1.19.1-1.1.20060mdk.x86_64.rpm
 c0fae16eb3f9c2a813f60b4e6b1dbfc5  x86_64/2006.0/RPMS/groff-for-man-1.19.1-1.1.20060mdk.x86_64.rpm
 2ff202c91cd6a3e864b92a6c317b4803  x86_64/2006.0/RPMS/groff-gxditview-1.19.1-1.1.20060mdk.x86_64.rpm
 7b877faf1a8db9af7e2d2808e100a4a5  x86_64/2006.0/RPMS/groff-perl-1.19.1-1.1.20060mdk.x86_64.rpm
 2821299644c84404e2fa743835722dab  x86_64/2006.0/SRPMS/groff-1.19.1-1.1.20060mdk.src.rpm

 Corporate 3.0:
 410ef29b051bfb96703154b26d16d631  corporate/3.0/RPMS/groff-1.19-6.1.C30mdk.i586.rpm
 0d5dc3e189003f6809f20dd9b9cb3209  corporate/3.0/RPMS/groff-for-man-1.19-6.1.C30mdk.i586.rpm
 cbdbf36d7826f0699dd609d7feb17f66  corporate/3.0/RPMS/groff-gxditview-1.19-6.1.C30mdk.i586.rpm
 4e9c264c0d49eb5838a38cd79e0b65a0  corporate/3.0/RPMS/groff-perl-1.19-6.1.C30mdk.i586.rpm
 b7a252f9135ebd8f1b9a8b56573f8ee0  corporate/3.0/SRPMS/groff-1.19-6.1.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 1c4328212aa64ecbd7f51ccba72718b6  x86_64/corporate/3.0/RPMS/groff-1.19-6.1.C30mdk.x86_64.rpm
 ea375e1f85f86dd87a886f32ea368228  x86_64/corporate/3.0/RPMS/groff-for-man-1.19-6.1.C30mdk.x86_64.rpm
 6e09c552c3953ffa6e99a7a31a8f3516  x86_64/corporate/3.0/RPMS/groff-gxditview-1.19-6.1.C30mdk.x86_64.rpm
 2f6f0e853b722e3a94b7dc09a65bcb38  x86_64/corporate/3.0/RPMS/groff-perl-1.19-6.1.C30mdk.x86_64.rpm
 b7a252f9135ebd8f1b9a8b56573f8ee0  x86_64/corporate/3.0/SRPMS/groff-1.19-6.1.C30mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Attackers Can ‘Steal’ Bandwidth From BitTorrent Seeders, Research Finds
Linux Kernel Development Gets Two-Factor Authentication
Hacking cars and traffic lights at Def Con
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.