CVE-2001-1593

The tempname_ensure function in lib/routines.h in a2ps 4.14 and earlier, as used by the spy_user function and possibly other functions, allows local users to modify arbitrary files via a symlink attack on a temporary file.

Weakness

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Affected Software

Name	Vendor	Start Version	End Version
A2ps	Gnu	*	4.14 (including)
A2ps	Gnu	4.10.3 (including)	4.10.3 (including)
A2ps	Gnu	4.10.4 (including)	4.10.4 (including)
A2ps	Gnu	4.12 (including)	4.12 (including)
A2ps	Gnu	4.13 (including)	4.13 (including)
A2ps	Gnu	4.13b (including)	4.13b (including)
A2ps	Ubuntu	lucid	*
A2ps	Ubuntu	precise	*

Potential Mitigations

Follow the principle of least privilege when assigning access rights to entities in a software system.
Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

NVD	https://nvd.nist.gov/vuln/detail/CVE-2001-1593
CWE	https://cwe.mitre.org/data/definitions/59.html

Improper Link Resolution Before File Access ('Link Following')

Weakness

Affected Software

Potential Mitigations

References

CVE-2001-1593

Improper Link Resolution Before File Access ('Link Following')

Weakness

Affected Software

Potential Mitigations

Related Attack Patterns

References