Weekly edition	Kernel	Security	Distributions	Contact Us	Search
Archives	Calendar	Subscribe	Write for LWN	LWN.net FAQ	Sponsors

thttpd: insecure temp file

Package(s):

thttpd

CVE #(s):

CVE-2005-3124

Created:

November 4, 2005

Updated:

November 9, 2005

Description:

Javier Fernández-Sanguino Peña from the Debian Security Audit team discovered that the syslogtocern script from thttpd, a tiny webserver, uses a temporary file insecurely, allowing a local attacker to craft a symlink attack to overwrite arbitrary files.

Alerts:

Debian

DSA-883-1

2005-11-04

(Log in to post comments)