PT-2001-1002 · Gnu · A2Ps

Published 2001-04-17 · Updated 2024-06-15 · CVE-2001-1593

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions a2ps versions 4.14 and earlier

Description The issue allows local users to modify arbitrary files via a symlink attack on a temporary file, potentially leading to disruption of confidentiality, integrity, and availability of protected information. This can be exploited by a local attacker to perform a symbolic link attack, modifying an arbitrary file accessible to the user running a2ps. The tempname ensure function in lib/routines.h is specifically vulnerable, as used by the spy user function and possibly other functions.

Recommendations For a2ps versions 4.14 and earlier, consider disabling the tempname ensure function or restricting its use until a patch is available. As a temporary workaround, avoid using the spy user function to minimize the risk of exploitation. Restrict access to temporary files used by a2ps to prevent symbolic link attacks.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

BDU:2015-02023

CVE-2001-1593

DSA-2892-1

OPENSUSE-SU-2024:12797-1

Affected Products

A2Ps

References · 21

• https://cve.org/CVERecord?id=CVE-2001-1593 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2001-1593 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12797-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2001-1593 · Vendor Advisory
• http://debian.org/security/2014/dsa-2892 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02023 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2001-1593 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1593 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2001-1593 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2001-1593 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0466 · Security Note
• https://ubuntu.com/security/CVE-2001-1593 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1060630 · Note
• https://altsp.su/obnovleniya-bezopasnosti · Note
• http://pkgs.fedoraproject.org/cgit/a2ps.git/plain/a2ps-4.13-security.patch · Note