sysreport before 1.3.7 allows local users to obtain sensitive information via a symlink attack on a temporary directory.

An updated sysreport package that fixes an insecure temporary file flaw is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Sysreport is a utility that gathers information about a system's hardware and configuration. The information can then be used for diagnostic purposes and debugging.

Bill Stearns discovered a bug in the way sysreport creates temporary files. It is possible that a local attacker could obtain sensitive information about the system when sysreport is run. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2104 to this issue.

Users of sysreport should update to this erratum package, which contains a patch that resolves this issue.

It is possible for a local attacker to cause a race condition and trick sysreport into writing its output to a directory the attacker can read.

The new sysreport fixes this security issue

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
21951	CentOS 3 / 4 : sysreport (CESA-2005:598)	Nessus	CentOS Local Security Checks	low
20192	Fedora Core 3 : sysreport-1.3.13-2 (2005-1072)	Nessus	Fedora Local Security Checks	low
20191	Fedora Core 4 : sysreport-1.4.1-5 (2005-1071)	Nessus	Fedora Local Security Checks	low
19409	RHEL 2.1 / 3 / 4 : sysreport (RHSA-2005:598)	Nessus	Red Hat Local Security Checks	low

Detections

Analytics

CVE-2005-2104

medium

Tenable Plugins

low

low

low

low