CVE-2011-1920 The make include files in NetBSD before 1.6.2, as used in pmake 1.111 and other products, allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_depend##### temporary file, rel...
LowCVSS 3.3
EPSS 0.44%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The make include files in NetBSD before 1.6.2, as used in pmake 1.111 and other products, allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_depend##### temporary file, related to (1) bsd.lib.mk and (2) bsd.prog.mk.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netbsd | All versions | No fix listed |
| netbsd | <= 1.6.1 | No fix listed |
| netbsd | = 1.0 | No fix listed |
| netbsd | = 1.1 | No fix listed |
| netbsd | = 1.2 | No fix listed |
| netbsd | = 1.2.1 | No fix listed |
| netbsd | = 1.3 | No fix listed |
| netbsd | = 1.3.1 | No fix listed |
| netbsd | = 1.3.2 | No fix listed |
| netbsd | = 1.3.3 | No fix listed |
| netbsd | = 1.4 | No fix listed |
| netbsd | = 1.4.1 | No fix listed |
| netbsd | = 1.4.2 | No fix listed |
| netbsd | = 1.4.3 | No fix listed |
| netbsd | = 1.5 | No fix listed |
| netbsd | = 1.5.1 | No fix listed |
| netbsd | = 1.5.2 | No fix listed |
| netbsd | = 1.5.3 | No fix listed |
| netbsd | = 1.6 | No fix listed |
| ihji pmake | = 1.111 | No fix listed |
References
- bugs.debian.org exploit patch
- cvsweb.netbsd.org patch
- cvsweb.netbsd.org patch
- [oss-security] 20110516 CVE Request -- pmake -- Use of insecure temporary file for 'depend' target exploit mailing-list patch
- [oss-security] 20110516 Re: CVE Request -- pmake -- Use of insecure temporary file for 'depend' target mailing-list patch
- 47878 vdb-entry
- bugzilla.redhat.com exploit patch
- bugzilla.redhat.com patch
- pmake-depend-symlink(67495) vdb-entry