GNU gv before 3.7.0 allows local users to overwrite arbitrary files via a symlink attack on a temporary file.
Weakness
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gv | Gnu | * | 3.6.9 (including) |
| Gv | Gnu | 3.5.8 (including) | 3.5.8 (including) |
| Gv | Gnu | 3.6.0 (including) | 3.6.0 (including) |
| Gv | Gnu | 3.6.1 (including) | 3.6.1 (including) |
| Gv | Gnu | 3.6.2 (including) | 3.6.2 (including) |
| Gv | Gnu | 3.6.3 (including) | 3.6.3 (including) |
| Gv | Gnu | 3.6.4 (including) | 3.6.4 (including) |
| Gv | Gnu | 3.6.5 (including) | 3.6.5 (including) |
| Gv | Gnu | 3.6.6 (including) | 3.6.6 (including) |
| Gv | Gnu | 3.6.7 (including) | 3.6.7 (including) |
| Gv | Gnu | 3.6.8 (including) | 3.6.8 (including) |
| Gv | Ubuntu | dapper | * |
| Gv | Ubuntu | hardy | * |
| Gv | Ubuntu | jaunty | * |
| Gv | Ubuntu | karmic | * |
| Gv | Ubuntu | lucid | * |
| Gv | Ubuntu | upstream | * |
Potential Mitigations
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/132.html
- https://cwe.mitre.org/data/definitions/17.html
- https://cwe.mitre.org/data/definitions/35.html
- https://cwe.mitre.org/data/definitions/76.html
References
- http://lists.fedoraproject.org/pipermail/package-announce/2010-July/043913.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-July/043948.html
- http://savannah.gnu.org/forum/forum.php?forum_id=6368
- http://secunia.com/advisories/40475
- http://secunia.com/advisories/40532
- http://www.osvdb.org/66249
- http://www.vupen.com/english/advisories/2010/1757
- https://bugzilla.redhat.com/show_bug.cgi?id=599621
- http://lists.fedoraproject.org/pipermail/package-announce/2010-July/043913.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-July/043948.html
- http://savannah.gnu.org/forum/forum.php?forum_id=6368
- http://secunia.com/advisories/40475
- http://secunia.com/advisories/40532
- http://www.osvdb.org/66249
- http://www.vupen.com/english/advisories/2010/1757
- https://bugzilla.redhat.com/show_bug.cgi?id=599621