It was found [1] that the Capture::Tiny module, provided by the perl-Capture-Tiny package, used the File::temp::tmpnam module to generate temporary files:
./lib/Capture/Tiny.pm: $stash->{flag_files}{$which} = scalar tmpnam();
This module makes use of the mktemp() function when called in the scalar context, which creates significantly more predictable temporary files. Additionally, the temporary file is created with world-writable (0666) permission. A local attacker could use this flaw to perform a symbolic link attack, overwriting arbitrary files accessible to a program using the Capture::Tiny module.
This issue has been reported upstream [2], but has not yet been fixed.
[1] http://seclists.org/oss-sec/2014/q1/267
[2] https://github.com/dagolden/Capture-Tiny/issues/16
Comment 6Fedora Update System
2014-02-22 00:49:43 UTC
perl-Capture-Tiny-0.24-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
Comment 7Fedora Update System
2014-02-22 01:00:27 UTC
perl-Capture-Tiny-0.24-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
It was found [1] that the Capture::Tiny module, provided by the perl-Capture-Tiny package, used the File::temp::tmpnam module to generate temporary files: ./lib/Capture/Tiny.pm: $stash->{flag_files}{$which} = scalar tmpnam(); This module makes use of the mktemp() function when called in the scalar context, which creates significantly more predictable temporary files. Additionally, the temporary file is created with world-writable (0666) permission. A local attacker could use this flaw to perform a symbolic link attack, overwriting arbitrary files accessible to a program using the Capture::Tiny module. This issue has been reported upstream [2], but has not yet been fixed. [1] http://seclists.org/oss-sec/2014/q1/267 [2] https://github.com/dagolden/Capture-Tiny/issues/16