PT-2004-1121 · Gnu · Gnu Gettext

Published 2004-10-20 · Updated 2017-07-11 · CVE-2004-0966

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions GNU gettext package versions 1.14 and later

Description The issue is related to errors in the code of the autopoint and gettextize scripts in the GNU gettext package. It allows local users to overwrite files via a symlink attack on temporary files. This can be exploited by a local attacker to manipulate symbolic links on temporary files, resulting in the overwrite of certain files.

Recommendations For GNU gettext package versions 1.14 and later, consider restricting access to the autopoint and gettextize scripts until a patch is available. As a temporary workaround, avoid using these scripts with temporary files that can be manipulated by local users.

Fix

Weakness Enumeration

CWE-17

Related Identifiers

BDU:2017-00286

CVE-2004-0966

Affected Products

Gnu Gettext

References · 16

• http://trustix.org/errata/2004/0050 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=110382652226638&w=2 · Vendor Advisory
• http://securityfocus.com/bid/11282 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200410-10.xml · Vendor Advisory
• http://redhat.com/archives/fedora-legacy-announce/2006-January/msg00000.html · Vendor Advisory
• https://ubuntu.com/usn/usn-5-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00286 · Security Note
• https://osv.dev/vulnerability/CVE-2004-0966 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-0966 · Vendor Advisory
• http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2006:051 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2004-0966 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0966 · Security Note
• http://xforce.iss.net/xforce/xfdb/17583 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17583 · Note
• http://marc.info/?l=bugtraq&m=110382652226638&w=2 · Note