The RenderV2ToFile function in tag_file.cpp in id3lib (aka libid3) 3.8.3 allows local users to overwrite arbitrary files via a symlink attack on a temporary file whose name is constructed from the name of a file being tagged.

The remote Solaris system is missing necessary patches to address security updates :

  - The RenderV2ToFile function in tag_file.cpp in id3lib     (aka libid3) 3.8.3 allows local users to overwrite     arbitrary files via a symlink attack on a temporary file     whose name is constructed from the name of a file being     tagged. (CVE-2007-4460)

  - poppler before 0.22.1 allows context-dependent attackers     to cause a denial of service (crash) and possibly     execute arbitrary code via vectors that trigger an     'invalid memory access' in (1) splash/Splash.cc, (2)     poppler/Function.cc, and (3) poppler/Stream.cc.
    (CVE-2013-1788)

  - splash/Splash.cc in poppler before 0.22.1 allows     context-dependent attackers to cause a denial of service     (NULL pointer dereference and crash) via vectors related     to the (1) Splash::arbitraryTransformMask, (2)     Splash::blitMask, and (3) Splash::scaleMaskYuXu     functions. (CVE-2013-1789)

  - poppler/Stream.cc in poppler before 0.22.1 allows     context-dependent attackers to have an unspecified     impact via vectors that trigger a read of uninitialized     memory by the CCITTFaxStream::lookChar function.
    (CVE-2013-1790)

This update fixes a bug that allows local attackers to overwrite arbitrary files. (CVE-2007-4460)

This security update fixes a (minor) tempfile creation security issue (CVE-2007-4460) by using mkstemp (bugzilla 253553)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Debian Bug report log reports :

When tagging file $foo, a temporary copy of the file is created, and for some reason, libid3 doesn't use mkstemp but just creates $foo.XXXXXX literally, without any checking.

This would silently truncate and overwrite an existing $foo.XXXXXX.

The remote host is affected by the vulnerability described in GLSA-200709-08 (id3lib: Insecure temporary file creation)

    Nikolaus Schulz discovered that the function RenderV2ToFile() in file     src/tag_file.cpp creates temporary files in an insecure manner.
  Impact :

    A local attacker could exploit this vulnerability via a symlink attack     to overwrite arbitrary files.
  Workaround :

    There is no known workaround at this time.

A programming error was found in id3lib by Nikolaus Schulz that could lead to a denial of service through symlink attacks.

Updated packages have been patched to prevent these issues.

Nikolaus Schulz discovered that a programming error in id3lib, an ID3 Tag Library, may lead to denial of service through symlink attacks.

ID	Name	Product	Family	Severity
80625	Oracle Solaris Third-Party Patch Update : gnome (cve_2007_4460_symlink_attack)	Nessus	Solaris Local Security Checks	high
41150	SuSE9 Security Update : id3lib (YOU Patch Number 11786)	Nessus	SuSE Local Security Checks	high
29462	SuSE 10 Security Update : id3lib (ZYPP Patch Number 4317)	Nessus	SuSE Local Security Checks	high
27732	Fedora 7 : id3lib-3.8.3-17.fc7 (2007-1774)	Nessus	Fedora Local Security Checks	high
27269	openSUSE 10 Security Update : id3lib (id3lib-4316)	Nessus	SuSE Local Security Checks	high
26212	FreeBSD : id3lib -- insecure temporary file creation (15ec9123-7061-11dc-b372-001921ab2fa4)	Nessus	FreeBSD Local Security Checks	high
26098	GLSA-200709-08 : id3lib: Insecure temporary file creation	Nessus	Gentoo Local Security Checks	high
26047	Mandrake Linux Security Advisory : id3lib (MDKSA-2007:180)	Nessus	Mandriva Local Security Checks	high
25965	Debian DSA-1365-3 : id3lib3.8.3 - programming error	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2007-4460

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high