Bug 481702 - (CVE-2008-5703) CVE-2008-5703 gpsdrive: insecure temporary file use in gpssmswatch and splash.c
CVE-2008-5703 gpsdrive: insecure temporary file use in gpssmswatch and splash.c
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
http://nvd.nist.gov/nvd.cfm?cvename=C...
impact=low,cwe=CWE-377[auto]
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-01-27 03:39 EST by Tomas Hoger
Modified: 2016-03-04 07:36 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-12-22 10:31:32 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Tomas Hoger 2009-01-27 03:39:01 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-5703 to the following vulnerability:

gpsdrive (aka gpsdrive-scripts) 2.10~pre4 allows local users to overwrite
arbitrary files via a symlink attack on the (a) /tmp/.smswatch or (b)
/tmp/gpsdrivepos temporary file, related to (1) examples/gpssmswatch and (2)
src/splash.c, different vectors than CVE-2008-4959 and CVE-2008-5380. 

References:
http://openwall.com/lists/oss-security/2008/12/17/15
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508597
http://sourceforge.net/tracker/index.php?func=detail&aid=2121124&group_id=148048&atid=770280
http://www.securityfocus.com/bid/32887
Comment 2 Kevin Fenzi 2009-02-02 22:53:51 EST
http://cvs.fedoraproject.org/viewvc/rpms/gpsdrive/devel/gpsdrive-2.09-CVE-2008-5703.patch?view=co

Checked into rawhide and built. 
Does that look ok? If so, I will push F9/F10 builds/updates.
Comment 3 Fedora Update System 2009-02-04 21:10:17 EST
gpsdrive-2.09-7.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2009-02-04 21:22:35 EST
gpsdrive-2.09-7.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.