Title: AStats Statistics Generator Local Insecure Temporary File Creation Vulnerability
Severity: MODERATE
Description:
aStats is a graphical statistics generator for aMule; aMule is a popular file sharing application for Unix and Unix-like platforms.
A local temporary file creation vulnerability reportedly affects aStats. This issue is due to a failure of the application to create and write to temporary files in a secure manner.
The problem presents itself when the affected utility generates some PNG image files as well as the 'aStats-Graphic-Signature-Generation' file insecurely. An attacker may trivially predict the names of the temporary files and create corresponding symbolic-link files. When an unsuspecting user activates the affected utility, the symbolic-link will be written to, potentially destroying sensitive files.
An attacker may leverage this issue to write to arbitrary files on the affected computer with the privileges of the unsuspecting user that activates the vulnerable utility.
Although only aStats version 1.6.5 is reportedly affected, it is likely other versions are affected as well.
Affected Products:
- aStats aStats 1.6.5
References:
- aStats: aStats Home Page
- aStats: aStats Project Page
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
