Vulnerability Note VU#487102

Multiple tools within the Netpbm package create temporary files in an insecure manner

Overview

Multiple tools within the Netpbm package create temporary files in an insecure manner.

I. Description

Netpbm is a toolkit that contains over 220 separate tools for manipulating graphic images. Multiple tools within the Netpbm package create temporary files insecurely.

II. Impact

A local attacker could overwrite arbitrary files with the privileges of the Netpbm tool process.

III. Solution

Upgrade or Apply Patch

Upgrade or apply patch as specified by your vendor.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Debian	Vulnerable	23-Jan-2004
NetPBM	Vulnerable	23-Jan-2004

References

http://www.debian.org/security/2004/dsa-426
http://sourceforge.net/projects/netpbm/
http://www.secunia.com/advisories/10662/

Credit

Thanks to Debian for the information contained in their security advisory.

This document was written by Damon Morda.

Other Information

Date Public:	2004-01-18
Date First Published:	2004-01-19
Date Last Updated:	2004-01-23
CERT Advisory:
CVE-ID(s):	CAN-2003-0924
NVD-ID(s):	CAN-2003-0924
US-CERT Technical Alerts:
Metric:	2.02
Document Revision:	11

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader