The sort_offline function for texindex in texinfo 4.8 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files.

From Red Hat Security Advisory 2006:0727 :

New Texinfo packages that fix various security vulnerabilities are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Texinfo is a documentation system that can produce both online information and printed output from a single source file.

A buffer overflow flaw was found in Texinfo's texindex command. An attacker could construct a carefully crafted Texinfo file that could cause texindex to crash or possibly execute arbitrary code when opened. (CVE-2006-4810)

A flaw was found in the way Texinfo's texindex command creates temporary files. A local user could leverage this flaw to overwrite files the user executing texindex has write access to. (CVE-2005-3011)

Users of Texinfo should upgrade to these updated packages which contain backported patches and are not vulnerable to these issues.

New Texinfo packages that fix various security vulnerabilities are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Texinfo is a documentation system that can produce both online information and printed output from a single source file.

A buffer overflow flaw was found in Texinfo's texindex command. An attacker could construct a carefully crafted Texinfo file that could cause texindex to crash or possibly execute arbitrary code when opened. (CVE-2006-4810)

A flaw was found in the way Texinfo's texindex command creates temporary files. A local user could leverage this flaw to overwrite files the user executing texindex has write access to. (CVE-2005-3011)

Users of Texinfo should upgrade to these updated packages which contain backported patches and are not vulnerable to these issues.

The remote host is running a version of Mac OS X 10.4 or 10.3 that does not have Security Update 2007-005 applied. 

This update fixes security flaws in the following applications :

Alias Manager BIND CoreGraphics crontabs fetchmail file iChat mDNSResponder PPP ruby screen texinfo VPN

Multiple vulnerabilities have been found in the GNU texinfo package, a documentation system for on-line information and printed output.

  - CVE-2005-3011     Handling of temporary files is performed in an insecure     manner, allowing an attacker to overwrite any file     writable by the victim.

  - CVE-2006-4810     A buffer overflow in util/texindex.c could allow an     attacker to execute arbitrary code with the victim's     access rights by inducing the victim to run texindex or     tex2dvi on a specially crafted texinfo file.

Frank Lichtenheld discovered that the 'texindex' program created temporary files in an insecure manner. This could allow a symlink attack to create or overwrite arbitrary files with the privileges of the user running texindex.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Frank Lichtenheld has discovered that texindex insecurely creates temporary files with predictable filenames. This is exploitable if a local attacker were to create symbolic links in the temporary files directory, pointing to a valid file on the filesystem. When texindex is executed, the file would be overwitten with the rights of the user running texindex.

The updated packages have been patched to correct this issue.

The remote host is affected by the vulnerability described in GLSA-200510-04 (Texinfo: Insecure temporary file creation)

    Frank Lichtenheld has discovered that the 'sort_offline()'     function in texindex insecurely creates temporary files with     predictable filenames.
  Impact :

    A local attacker could create symbolic links in the temporary     files directory, pointing to a valid file somewhere on the filesystem.
    When texindex is executed, this would result in the file being     overwritten with the rights of the user running the application.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
67419	Oracle Linux 3 / 4 : texinfo (ELSA-2006-0727)	Nessus	Oracle Linux Local Security Checks	medium
67037	CentOS 3 / 4 : texinfo (CESA-2006:0727-1)	Nessus	CentOS Local Security Checks	medium
37714	CentOS 3 / 4 : texinfo (CESA-2006:0727)	Nessus	CentOS Local Security Checks	medium
25297	Mac OS X Multiple Vulnerabilities (Security Update 2007-005)	Nessus	MacOS X Local Security Checks	critical
23742	Debian DSA-1219-1 : texinfo - buffer overflow	Nessus	Debian Local Security Checks	medium
23678	RHEL 2.1 / 3 / 4 : texinfo (RHSA-2006:0727)	Nessus	Red Hat Local Security Checks	medium
20608	Ubuntu 4.10 / 5.04 : texinfo vulnerability (USN-194-1)	Nessus	Ubuntu Local Security Checks	low
19984	Mandrake Linux Security Advisory : texinfo (MDKSA-2005:175)	Nessus	Mandriva Local Security Checks	low
19974	GLSA-200510-04 : Texinfo: Insecure temporary file creation	Nessus	Gentoo Local Security Checks	low

Detections

Analytics

CVE-2005-3011

medium

Tenable Plugins

medium

medium

medium

critical

medium

medium

low

low

low