pwmconfig in LM_sensors before 2.9.1 creates temporary files insecurely, which allows local users to overwrite arbitrary files via a symlink attack on the fancontrol temporary file.

Updated lm_sensors packages that fix an insecure file issue are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The lm_sensors package includes a collection of modules for general SMBus access and hardware monitoring. This package requires special support which is not in standard version 2.2 kernels.

A bug was found in the way the pwmconfig tool creates temporary files.
It is possible that a local attacker could leverage this flaw to overwrite arbitrary files located on the system. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2672 to this issue.

Users of lm_sensors are advised to upgrade to these updated packages, which contain a backported patch that resolves this issue.

The lm_sensors package includes a collection of modules for general SMBus access and hardware monitoring. NOTE: this package requires special support which is not in standard 2.2-vintage kernels.

A bug was found in the pwmconfig tool which uses temporary files in an insecure manner. The pwconfig tool writes a configuration file which may be world readable for a short period of time. This file contains various information about the setup of lm_sensors on that machine. It could be modified within the short window to contain configuration data that would either render lm_sensors unusable or in the worst case even hang the machine resulting in a DoS. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2672 to this issue.

Users of lm_sensors are advised to upgrade to these updated packages, which contain a patch which resolves this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Javier Fernandez-Sanguino Pena discovered that the pwmconfig script in the lm_sensors package created temporary files in an insecure manner.
This could allow a symlink attack to create or overwrite arbitrary files with full root privileges because pwmconfig is typically executed by root.

The updated packages have been patched to correct this problem by using mktemp to create the temporary files.

Javier Fernandez-Sanguino Pena discovered that a script of lm-sensors, utilities to read temperature/voltage/fan sensors, creates a temporary file with a predictable filename, leaving it vulnerable for a symlink attack.

The remote host is affected by the vulnerability described in GLSA-200508-19 (lm_sensors: Insecure temporary file creation)

    Javier Fernandez-Sanguino Pena has discovered that lm_sensors     insecurely creates temporary files with predictable filenames when     saving configurations.
  Impact :

    A local attacker could create symbolic links in the temporary file     directory, pointing to a valid file somewhere on the filesystem. When     the pwmconfig script of lm_sensors is executed, this would result in     the file being overwritten with the rights of the user running the     script, which typically is the root user.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
21968	CentOS 4 : lm_sensors (CESA-2005:825)	Nessus	CentOS Local Security Checks	low
20205	RHEL 4 : lm_sensors (RHSA-2005:825)	Nessus	Red Hat Local Security Checks	low
20166	Fedora Core 3 : lm_sensors-2.8.7-2.FC3.1 (2005-1054)	Nessus	Fedora Local Security Checks	low
20165	Fedora Core 4 : lm_sensors-2.9.1-3.FC4.1 (2005-1053)	Nessus	Fedora Local Security Checks	low
19905	Mandrake Linux Security Advisory : lm_sensors (MDKSA-2005:149)	Nessus	Mandriva Local Security Checks	low
19710	Debian DSA-814-1 : lm-sensors - insecure temporary file	Nessus	Debian Local Security Checks	low
19572	GLSA-200508-19 : lm_sensors: Insecure temporary file creation	Nessus	Gentoo Local Security Checks	low

Detections

Analytics

CVE-2005-2672

medium

Tenable Plugins

low

low

low

low

low

low

low