Mandrakelinux Advisory: ksymoops Jun 11, 2004, 03 :15 UTC (0 Talkback[s]) (2183 reads)
Mandrakelinux Security Update Advisory
Package name: ksymoops
Advisory ID: MDKSA-2004:060
Date: June 10th, 2004
Affected versions: 10.0, 9.1, 9.2, Corporate Server 2.1
Problem Description:
Geoffrey Lee discovered a problem with the ksymoops-gznm script
distributed with Mandrakelinux. The script fails to do proper checking
when copying a file to the /tmp directory. Because of this, a local
attacker can setup a symlink to point to a file that they do not have
permission to remove. The problem is difficult to exploit because
someone with root privileges needs to run ksymoops on a particular
module for which a symlink for the same filename already exists.
