sch2eaglepos.sh in geda-gnetlist 1.4.0 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/##### temporary file.

CVE-2008-5148 geda-gnetlist insecure temporary file use

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200903-08 (gEDA: Insecure temporary file creation)

    Dmitry E. Oboukhov reported an insecure temporary file usage within the     sch2eaglepos.sh script.
  Impact :

    A local attacker could perform symlink attacks to overwrite arbitrary     files with the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
62271	Fedora 10 : geda-gnetlist-20080929-2.fc10 (2008-10010)	Nessus	Fedora Local Security Checks	medium
35798	GLSA-200903-08 : gEDA: Insecure temporary file creation	Nessus	Gentoo Local Security Checks	medium
34831	Fedora 9 : geda-gnetlist-20080929-2.fc9 (2008-9730)	Nessus	Fedora Local Security Checks	medium
34826	Fedora 8 : geda-gnetlist-20080929-2.fc8 (2008-9694)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2008-5148

medium

Tenable Plugins

medium

medium

medium

medium