main.c in cscope 15-4 and 15-5 creates temporary files with predictable filenames, which allows local users to overwrite arbitrary files via a symlink attack.

The remote host is running a version of Mac OS X 10.4 or 10.3 which does not have the security update 2007-007 applied. 

This update contains several security fixes for the following programs :

 - bzip2
 - CFNetwork
 - CoreAudio
 - cscope
 - gnuzip
 - iChat
 - Kerberos
 - mDNSResponder
 - PDFKit
 - PHP
 - Quartz Composer
 - Samba
 - SquirrelMail
 - Tomcat
 - WebCore
 - WebKit

cscope is vulnerable to a symlink attack which could lead to an attacker overwriting arbitrary files with the permissions of the user running cscope.

A vulnerability has been discovered in cscope, a program to interactively examine C source code, which may allow local users to overwrite files via a symlink attack.

The remote host is affected by the vulnerability described in GLSA-200412-11 (Cscope: Insecure creation of temporary files)

    Cscope creates temporary files in world-writable directories with     predictable names.
  Impact :

    A local attacker could create symbolic links in the temporary     files directory, pointing to a valid file somewhere on the filesystem.
    When Cscope is executed, this would result in the file being     overwritten with the rights of the user running the utility, which     could be the root user.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
25830	Mac OS X Multiple Vulnerabilities (Security Update 2007-007)	Nessus	MacOS X Local Security Checks	critical
19067	FreeBSD : cscope -- symlink attack vulnerability (a7bfd423-484f-11d9-a9e7-0001020eed82)	Nessus	FreeBSD Local Security Checks	low
15994	Debian DSA-610-1 : cscope - insecure temporary file	Nessus	Debian Local Security Checks	low
15989	GLSA-200412-11 : Cscope: Insecure creation of temporary files	Nessus	Gentoo Local Security Checks	low

Detections

Analytics

CVE-2004-0996

medium

Tenable Plugins

critical

low

low

low