FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  321198
Date:      2013-06-18
Time:      15:50:05Z
Committer: delphij

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML ID Description

VuXML ID	Description
22f00553-a09d-11d9-a788-0001020eed82	portupgrade -- insecure temporary file handling vulnerability Simon L. Nielsen discovered that portupgrade handles temporary files in an insecure manner. This could allow an unprivileged local attacker to execute arbitrary commands or overwrite arbitrary files with the permissions of the user running portupgrade, typically root, by way of a symlink attack. The following issues exist where the temporary files are created, by default in the world writeable directory /var/tmp, with the permissions of the user running portupgrade: pkg_fetch download packages with a predictable local filename allowing a local attacker to overwrite arbitrary local files or potentially replace the downloaded package after download but before install with a package with malicious content, allowing the attacker to run arbitrary commands. portupgrade will, when upgrading ports/packages, write the old package to a predictable temporary file, allowing an attacker to overwrite arbitrary files via a symlink attack. portupgrade will touch a temporary file with a constant filename (pkgdb.fixme) allowing an attacker to create arbitrary zero-byte files via a symlink attack. A workaround for these issues is to set the `PKG_TMPDIR` environment variable to a directory only write-able by the user running portupgrade. Discovery 2005-04-12 Entry 2005-04-12 portupgrade lt 20041226_2 CVE-2005-0610
22f00553-a09d-11d9-a788-0001020eed82	portupgrade -- insecure temporary file handling vulnerability Simon L. Nielsen discovered that portupgrade handles temporary files in an insecure manner. This could allow an unprivileged local attacker to execute arbitrary commands or overwrite arbitrary files with the permissions of the user running portupgrade, typically root, by way of a symlink attack. The following issues exist where the temporary files are created, by default in the world writeable directory /var/tmp, with the permissions of the user running portupgrade: pkg_fetch download packages with a predictable local filename allowing a local attacker to overwrite arbitrary local files or potentially replace the downloaded package after download but before install with a package with malicious content, allowing the attacker to run arbitrary commands. portupgrade will, when upgrading ports/packages, write the old package to a predictable temporary file, allowing an attacker to overwrite arbitrary files via a symlink attack. portupgrade will touch a temporary file with a constant filename (pkgdb.fixme) allowing an attacker to create arbitrary zero-byte files via a symlink attack. A workaround for these issues is to set the `PKG_TMPDIR` environment variable to a directory only write-able by the user running portupgrade. Discovery 2005-04-12 Entry 2005-04-12 portupgrade lt 20041226_2 CVE-2005-0610

22f00553-a09d-11d9-a788-0001020eed82

portupgrade -- insecure temporary file handling vulnerability

Simon L. Nielsen discovered that portupgrade handles temporary files in an insecure manner. This could allow an unprivileged local attacker to execute arbitrary commands or overwrite arbitrary files with the permissions of the user running portupgrade, typically root, by way of a symlink attack.

The following issues exist where the temporary files are created, by default in the world writeable directory /var/tmp, with the permissions of the user running portupgrade:

pkg_fetch download packages with a predictable local filename allowing a local attacker to overwrite arbitrary local files or potentially replace the downloaded package after download but before install with a package with malicious content, allowing the attacker to run arbitrary commands.
portupgrade will, when upgrading ports/packages, write the old package to a predictable temporary file, allowing an attacker to overwrite arbitrary files via a symlink attack.
portupgrade will touch a temporary file with a constant filename (pkgdb.fixme) allowing an attacker to create arbitrary zero-byte files via a symlink attack.

A workaround for these issues is to set the PKG_TMPDIR environment variable to a directory only write-able by the user running portupgrade.

Discovery 2005-04-12
Entry 2005-04-12
portupgrade

lt 20041226_2

CVE-2005-0610