Title: Gnome Installer System Config-file Overwrite Vulnerability
Severity: LOW
Description:
GNOME is a graphical user interface for X11 created by Helix Code. The installer, on Caldera eDesktop and S.u.S.E. linux systems use /tmp in an unsafe manner. It creates a directory in /tmp and stores temporary copies of system configuration files (/etc/config.d/bashrc, /etc/config.d/csh.cshrc, and /etc/rc.d/rc.gui files on Caldera OpenLinux eDesktop 2.4 and /etc/rc.config on SuSE 6.3 and 6.4) there before writing them to their proper locations. If a malicious user has knowledge that the administrator is going to be executing gnome-installer, he/she can cause the installer to write blank configuration files to the system (by making the directory before gnome installer does). This will result in the system losing part of its configuration.
Affected Products:
- Helix Code GNOME Installer 0.2.0
- S.u.S.E. Linux 6.3.0
- S.u.S.E. Linux 6.4.0
- SCO eDesktop 2.4.0
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
