plugin/npapi/plugin.cpp in Gnash before 0.8.10 uses weak permissions (world readable) for cookie files with predictable names in /tmp, which allows local users to obtain sensitive information.

gnash used predictable and world readable temporary file names to store HTTP cookies (CVE-2011-4328).

gnash used predictable and world readable temporary file names to store HTTP cookies

The remote host is affected by the vulnerability described in GLSA-201207-08 (Gnash: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in Gnash:
      The 'nsPluginInstance::setupCookies()' function in plugin.cpp creates         world-readable cookies with predictable file names (CVE-2011-4328).
      The 'GnashImage::size()' function in GnashImage.h contains an integer         overflow error which could cause a heap-based buffer overflow         (CVE-2012-1175).
  Impact :

    A remote attacker could entice a user to open a specially crafted SWF       file, possibly resulting in execution of arbitrary code or a Denial of       Service condition. Furthermore, a local attacker may be able to obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been identified in Gnash, the GNU Flash player.

  - CVE-2012-1175     Tielei Wang from Georgia Tech Information Security     Center discovered a vulnerability in GNU Gnash which is     caused due to an integer overflow error and can be     exploited to cause a heap-based buffer overflow by     tricking a user into opening a specially crafted SWF     file.

  - CVE-2011-4328     Alexander Kurtz discovered an unsafe management of HTTP     cookies. Cookie files are stored under /tmp and have     predictable names, and the vulnerability allows a local     attacker to overwrite arbitrary files the users has     write permissions for, and are also world-readable which     may cause information leak.

  - CVE-2010-4337     Jakub Wilk discovered an unsafe management of temporary     files during the build process. Files are stored under     /tmp and have predictable names, and the vulnerability     allows a local attacker to overwrite arbitrary files the     users has write permissions for.

Update to 0.8.10

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75854	openSUSE Security Update : gnash (openSUSE-SU-2012:0330-1)	Nessus	SuSE Local Security Checks	medium
74569	openSUSE Security Update : gnash (openSUSE-SU-2012:0369-1)	Nessus	SuSE Local Security Checks	medium
59900	GLSA-201207-08 : Gnash: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
58392	Debian DSA-2435-1 : gnash - several vulnerabilities	Nessus	Debian Local Security Checks	medium
58297	Fedora 16 : gnash-0.8.10-1.fc16 (2012-2771)	Nessus	Fedora Local Security Checks	medium
58296	Fedora 15 : gnash-0.8.10-1.fc15 (2012-2719)	Nessus	Fedora Local Security Checks	medium
58258	Fedora 17 : gnash-0.8.10-1.fc17 (2012-2617)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-4328

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium