Weekly edition	Kernel	Security	Distributions	Contact Us	Search
Archives	Calendar	Subscribe	Write for LWN	LWN.net FAQ	Sponsors

cdrecord: insecure temp file

Package(s):

cdrecord

CVE #(s):

CAN-2005-0866

Created:

March 24, 2005

Updated:

April 28, 2005

Description:

The cdrecord utility makes insecure temp files if DEBUG is enabled in /etc/cdrecord/rscsi. This can allow a local user to launch a sym link attack and execute code with the user's privileges.

Alerts:

Mandriva	MDKSA-2005:077	2005-04-20
Ubuntu	USN-100-1	2005-03-24

(Log in to post comments)

cdrecord: insecure temp file

Posted Apr 28, 2005 7:45 UTC (Thu) by mjc@redhat.com (guest, #2303) [Link]

CAN-2005-0866