Rapid7 Vulnerability & Exploit Database

RHSA-2002:186: Updated scrollkeeper packages fix tempfile vulnerability

Back to Search

RHSA-2002:186: Updated scrollkeeper packages fix tempfile vulnerability

Severity
2
CVSS
(AV:L/AC:L/Au:N/C:N/I:P/A:N)
Published
10/04/2002
Created
07/25/2018
Added
10/28/2005
Modified
07/04/2017

Description

Updated scrollkeeper packages are now available for Red Hat Linux 7.3 which fix a tempfile vulnerability.

ScrollKeeper is a cataloging system for documentation. All versions of ScrollKeeper between 0.3 and 0.3.11 have a tempfile vulnerability. The scrollkeeper-get-cl command generates temporary files in the /tmp directory. These files are named scrollkeeper-tempfile.[0-4], and while creating these files scrollkeeper-get-cl follows symbolic links. These files are created when a user logs in to a GNOME session and are created as the user who logged in. This means an attacker with local access can easily create and overwrite files as another user. This errata updates ScrollKeeper packages for Red Hat Linux 7.3 with patches that prevent ScrollKeeper from following symlinks when creating temporary files. Previous releases of Red Hat Linux do not contain vulnerable versions of Scrollkeeper. Thanks go to Spybreak for discovering and responsibly disclosing this vulnerability.

Solution(s)

  • redhat-upgrade-scrollkeeper

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;