Title: GNU A2PS fixps.in Script Insecure Temporary File Vulnerability
Severity: LOW
Description:
GNU a2ps is a file utility that allows users to convert virtually any file type to PostScript files. It is freely available for UNIX/Linux operating systems and for Microsoft Windows.
GNU a2ps is prone to a vulnerability that may allow local attackers to corrupt files. This issue occurs because the 'fixps.in' script creates temporary files in an insecure manner, allowing symbolic-link attacks. For example, if the attacker were to create a symlink that is named after one of the temporary files created by the script, then any actions performed by the vulnerable script on the temporary file would actually be performed on the attacker-specified file pointed to by the symlink. For this to occur, the file pointed to by the symlink would have to be writeable by the user running the script.
An attack could cause files to be overwritten or appended to, most likely resulting in a denial of service. It is not known if attackers could leverage this issue to elevate privileges.
Affected Products:
- Debian Linux 3.0.0
- Debian Linux 3.0.0 alpha
- Debian Linux 3.0.0 arm
- Debian Linux 3.0.0 hppa
- Debian Linux 3.0.0 ia-32
- Debian Linux 3.0.0 ia-64
- Debian Linux 3.0.0 m68k
- Debian Linux 3.0.0 mips
- Debian Linux 3.0.0 mipsel
- Debian Linux 3.0.0 ppc
- Debian Linux 3.0.0 s/390
- Debian Linux 3.0.0 sparc
- GNU a2ps 4.13.0
- GNU a2ps 4.13.0b
- MandrakeSoft Corporate Server 2.1.0
- MandrakeSoft Corporate Server 2.1.0 x86_64
- MandrakeSoft Corporate Server 3.0.0
- MandrakeSoft Corporate Server 3.0.0 x86_64
- MandrakeSoft Linux Mandrake 10.0.0
- MandrakeSoft Linux Mandrake 10.0.0 amd64
- MandrakeSoft Linux Mandrake 10.1.0
- MandrakeSoft Linux Mandrake 10.1.0 x86_64
- MandrakeSoft Linux Mandrake 10.2.0
- MandrakeSoft Linux Mandrake 10.2.0 x86_64
- MandrakeSoft Linux Mandrake 9.2.0
- MandrakeSoft Linux Mandrake 9.2.0 amd64
- OpenPKG OpenPKG 2.1.0
- OpenPKG OpenPKG 2.2.0
- OpenPKG OpenPKG Current
- Turbolinux Home
- Turbolinux Turbolinux Desktop 10.0.0
- Turbolinux Turbolinux Server 10.0.0
- Turbolinux Turbolinux Server 7.0.0
- Turbolinux Turbolinux Server 8.0.0
- Turbolinux Turbolinux Workstation 7.0.0
- Turbolinux Turbolinux Workstation 8.0.0
References:
- GNU: a2ps Home Page
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
