National Cyber-Alert System

Vulnerability Summary for CVE-2009-0032

Overview

CUPS on Mandriva Linux 2008.0, 2008.1, 2009.0, Corporate Server (CS) 3.0 and 4.0, and Multi Network Firewall (MNF) 2.0 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/pdf.log temporary file.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Red Hat (01/27/2009)

Not vulnerable. Red Hat does not ship the vulnerable backend that causes this flaw.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: XF

Name: cups-pdflog-symlink(48210)

Hyperlink:http://xforce.iss.net/xforce/xfdb/48210

External Source: BID

Name: 33418

Hyperlink:http://www.securityfocus.com/bid/33418

External Source: MANDRIVA

Name: MDVSA-2009:029

Type: Advisory

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2009:029

External Source: MANDRIVA

Name: MDVSA-2009:028

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2009:028

External Source: MANDRIVA

Name: MDVSA-2009:027

Type: Advisory

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2009:027

External Source: SECTRACK

Name: 1021637

Hyperlink:http://securitytracker.com/id?1021637