glsa-200411-17.xml


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="200411-17">
  <title>mtink: Insecure tempfile handling</title>
  <synopsis>
    mtink is vulnerable to symlink attacks, potentially allowing a local user
    to overwrite arbitrary files with the rights of the user running the
    utility.
  </synopsis>
  <product type="ebuild">mtink</product>
  <announced>2004-11-09</announced>
  <revised count="02">2006-05-22</revised>
  <bug>70310</bug>
  <access>local</access>
  <affected>
    <package name="net-print/mtink" auto="yes" arch="*">
      <unaffected range="ge">1.0.5</unaffected>
      <vulnerable range="lt">1.0.5</vulnerable>
    </package>
  </affected>
  <background>
    <p>
    mtink is a status monitor and inkjet cartridge changer for some Epson
    printers.
    </p>
  </background>
  <description>
    <p>
    Tavis Ormandy from Gentoo Linux discovered that mtink uses insecure
    permissions on temporary files.
    </p>
  </description>
  <impact type="normal">
    <p>
    A local attacker could create symbolic links in the temporary files
    directory, pointing to a valid file somewhere on the filesystem. When
    mtink is executed, this would result in the file being overwritten with
    the rights of the user running the utility, which could be the root
    user.
    </p>
  </impact>
  <workaround>
    <p>
    There is no known workaround at this time.
    </p>
  </workaround>
  <resolution>
    <p>
    All mtink users should upgrade to the latest version:
    </p>
    <code>
    # emerge --sync
    # emerge --ask --oneshot --verbose "&gt;=net-print/mtink-1.0.5"</code>
  </resolution>
  <references>
    <uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1110">CVE-2004-1110</uri>
  </references>
  <metadata tag="requester" timestamp="2004-11-08T11:16:34Z">
    jaervosz
  </metadata>
  <metadata tag="bugReady" timestamp="2004-11-08T11:16:46Z">
    jaervosz
  </metadata>
  <metadata tag="submitter" timestamp="2004-11-08T21:01:51Z">
    jaervosz
  </metadata>
</glsa>