[ GLSA 200812-12 ] Honeyd: Insecure temporary file creation

[GLSA]

Gentoo Linux Security Advisory

Title: Honeyd: Insecure temporary file creation (GLSA 200812-12)
Severity: normal
Exploitable: local
Date: December 12, 2008
Bug(s): #237481
ID: 200812-12

Synopsis


An insecure temporary file usage has been reported in Honeyd, possibly
leading to symlink attacks.


Background


Honeyd is a small daemon that creates virtual hosts on a network.


Affected Packages

Package: net-analyzer/honeyd
Vulnerable: < 1.5c-r1
Unaffected: >= 1.5c-r1
Architectures: All supported architectures


Description


Dmitry E. Oboukhov reported an insecure temporary file usage within the
"test.sh" script.


Impact


A local attacker could perform symlink attacks and overwrite arbitrary
files with the privileges of the user running the application.


Workaround


There is no known workaround at this time.


Resolution


All Honeyd users should upgrade to the latest version: