SuSE Inc. Information for VU#336083
Uudecode performs inadequate checks on user-specified output files
- Vendor Information Help Date Notified: 15 Jul 2002
- Statement Date:
- Date Updated: 22 Jul 2002
Unknown. If you are the vendor named above, please contact us to update your status.
The SuSE security team has been aware of this issue for several years. We would like to point out that not overwriting existing files is not sufficient protection, as an attacker may also gain access by creating files that were not there previously (e.g. many people don't have ~/.shosts or ~/.ssh/authorized_keys2).
The best solution in our opinion is to make sure that all mail user agents etc always invoke uudecode with a filename argument on the command line. This is the case for SuSE Linux, so we do not consider ourselves vulnerable to this issue.
The vendor has not provided us with any further information regarding this vulnerability.
This statement from the SuSE Security Team provides no indication that this vulnerability has been addressed.
If you have feedback, comments, or additional information about this vulnerability, please send us email.