Gentoo: 'eroaster' temporary file vulnerability
Posted by LinuxSecurity.com Team   
Gentoo Previous eroaster versions allowwed local users to overwrite arbitraryfiles via a symlink attack on a temporary file that is used as a lockfile.

- - ---------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200309-04
- - ---------------------------------------------------------------------

          PACKAGE : eroaster
          SUMMARY : symlink attack
             DATE : 2003-09-02 09:57 UTC
          EXPLOIT : local
VERSIONS AFFECTED : =eroaster-2.1.0-r2
              CVE : CAN-2003-0656

- - ---------------------------------------------------------------------

Previous eroaster versions allowwed local users to overwrite arbitrary
files via a symlink attack on a temporary file that is used as a lockfile.

SOLUTION

It is recommended that all Gentoo Linux users who are running
app-cdr/eroaster upgrade to eroaster-2.1.0-r2 as follows:

emerge sync
emerge eroaster
emerge clean

- - ---------------------------------------------------------------------
aliz@gentoo.org - GnuPG key is available at  http://dev.gentoo.org/~aliz
- - ---------------------------------------------------------------------