SuSE Inc. Information for VU#336083

Uudecode performs inadequate checks on user-specified output files

Status

Unknown. If you are the vendor named above, please contact us to update your status.

Vendor Statement

The SuSE security team has been aware of this issue for several years. We would like to point out that not overwriting existing files is not sufficient protection, as an attacker may also gain access by creating files that were not there previously (e.g. many people don't have ~/.shosts or ~/.ssh/authorized_keys2).

The best solution in our opinion is to make sure that all mail user agents etc always invoke uudecode with a filename argument on the command line. This is the case for SuSE Linux, so we do not consider ourselves vulnerable to this issue.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Vendor References

None

Addendum

This statement from the SuSE Security Team provides no indication that this vulnerability has been addressed.

If you have feedback, comments, or additional information about this vulnerability, please send us email.