The (1) cfmailfilter and (2) cfcron.in files for cfengine 1.6.5 allow local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CVE-2005-2960.

A Debian Security Advisory reports :

Javier Fernandez-Sanguino Pena discovered several insecure temporary file uses in cfengine, a tool for configuring and maintaining networked machines, that can be exploited by a symlink attack to overwrite arbitrary files owned by the user executing cfengine, which is probably root.

Javier Fernandez-Sanguino Pena discovered that several tools in the cfengine package (vicf, cfmailfilter, and cfcron) create and use temporary files in an insecure way. A local attacker could exploit this with a symlink attack to create or overwrite arbitrary files with the privileges of the user running the cfengine program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Javier Fern&aacute;ndez-Sanguino Pe&ntilde;a discovered several insecure temporary file uses in cfengine <= 1.6.5 and <= 2.1.16 which allows local users to overwrite arbitrary files via a symlink attack on temporary files used by vicf.in. (CVE-2005-2960)

In addition, Javier discovered the cfmailfilter and cfcron.in files for cfengine <= 1.6.5 allow local users to overwrite arbitrary files via a symlink attack on temporary files (CVE-2005-3137)

The updated packages have been patched to address this issue.

Javier Fernandez-Sanguino Pena discovered insecure temporary file use in cfengine2, a tool for configuring and maintaining networked machines, that can be exploited by a symlink attack to overwrite arbitrary files owned by the user executing cfengine, which is probably root.

The oldstable distribution (woody) is not affected by this problem.

Javier Fernandez-Sanguino Pena discovered several insecure temporary file uses in cfengine, a tool for configuring and maintaining networked machines, that can be exploited by a symlink attack to overwrite arbitrary files owned by the user executing cfengine, which is probably root.

ID	Name	Product	Family	Severity
21464	FreeBSD : cfengine -- arbitrary file overwriting vulnerability (8688d5cd-328c-11da-a263-0001020eed82)	Nessus	FreeBSD Local Security Checks	low
20612	Ubuntu 4.10 / 5.04 : cfengine vulnerabilities (USN-198-1)	Nessus	Ubuntu Local Security Checks	low
20043	Mandrake Linux Security Advisory : cfengine (MDKSA-2005:184)	Nessus	Mandriva Local Security Checks	low
19805	Debian DSA-836-1 : cfengine2 - insecure temporary files	Nessus	Debian Local Security Checks	low
19804	Debian DSA-835-1 : cfengine - insecure temporary files	Nessus	Debian Local Security Checks	low

Detections

Analytics

CVE-2005-3137

medium

Tenable Plugins

low

low

low

low

low