CVE-2004-1377 The (1) fixps (aka fixps.in) and (2) psmandup (aka psmandup.in) scripts in a2ps before 4.13 allow local users to overwrite arbitrary files via a symlink attack on temporary files.
LowCVSS 2.1
EPSS 0.36%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The (1) fixps (aka fixps.in) and (2) psmandup (aka psmandup.in) scripts in a2ps before 4.13 allow local users to overwrite arbitrary files via a symlink attack on temporary files.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU a2ps | = 4.13 | No fix listed |
| GNU a2ps | = 4.13b | No fix listed |
| turbolinux home | All versions | No fix listed |
| turbolinux server | = 7.0 | No fix listed |
| turbolinux server | = 8.0 | No fix listed |
| turbolinux workstation | = 7.0 | No fix listed |
| turbolinux workstation | = 8.0 | No fix listed |
| debian/a2ps(Debian:12) | < 1:4.13b-4.3 | 1:4.13b-4.3 |
| debian/a2ps(Debian:13) | < 1:4.13b-4.3 | 1:4.13b-4.3 |
| debian/a2ps(Debian:14) | < 1:4.13b-4.3 | 1:4.13b-4.3 |
References
- 13641 third-party-advisory vendor-advisory
- GLSA-200501-02 patch vendor-advisory
- 12108 patch vdb-entry
- 12109 patch vdb-entry
- www.vuxml.org
- gnu-a2ps-fixpsin-symlink(18671) vdb-entry
- gnu-a2ps-psmanupin-symlink(18672) vdb-entry
- Debian Security Tracker CVE-2004-1377 vendor-advisory
- bugs.debian.org issue-tracking