Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 525
Alerts This Week
Warning Icon 1 525

Gentoo: GLSA-200501-43 Normal: Insecure f2c File Creation Issue

gentoo
Calendar Grey January 30, 2005
Scroller Gentoo
Uncover the vulnerabilities associated with f2c's insecure handling of temporary files on Gentoo. Implement measures to avert possible symlink exploits.
f2c is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files.

Summary

Gentoo Linux Security Advisory GLSA 200501-43 https://security.gentoo.org/ Severity: Normal Title: f2c: Insecure temporary file creation Date: January 30, 2005 Bugs: #79725 ID: 200501-43

Synopsis ======= f2c is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files.
Background ========= f2c is a Fortran to C translator. Portage uses this package in some ebuilds to build Fortran sources.
Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-lang/f2c <= 20030320 >= 20030320-r1
========== Javier Fernandez-Sanguino Pena from the Debian Security Audit Team discovered that f2c creates temporary files in world-writeable directories with predictable names.
Impact ...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory gentoo symlink attack local attack insecure file creation normal severity f2c package

Resolution

References

Availability

style>.gentoo_availability{display:block;}

Concerns

Topics%20covered

Topics Covered

security advisory gentoo symlink attack local attack insecure file creation normal severity f2c package

Synopsis

Background

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

Impact

Workaround