PT-2011-1200 · Gnu+1 · Groff+1

Nico Golde · Published 2011-06-30 · Updated 2024-06-15 · CVE-2009-5081

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions groff versions prior to 1.22.2

Description The issue affects the groff package in Gentoo Linux, potentially leading to integrity and availability breaches of protected information. Exploitation can be done remotely. Specifically, in GNU troff (aka groff) 1.21 and earlier, certain scripts such as config.guess, contrib/groffer/perl/groffer.pl, and contrib/groffer/perl/roff2.pl use an insufficient number of X characters in the template argument to the tempfile function. This makes it easier for local users to overwrite arbitrary files via a symlink attack on a temporary file.

Recommendations For versions prior to 1.22.2, update to version 1.22.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the config.guess, groffer.pl, and roff2.pl scripts to minimize the risk of exploitation. Avoid using the tempfile function with insufficient X characters in the template argument until the issue is resolved.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

ALT-PU-2016-1079

BDU:2015-09687

CVE-2009-5081

OPENSUSE-SU-2024:10031-1

Affected Products

Alt Linux

Groff

References · 22

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5079 · Security Note
• http://openwall.com/lists/oss-security/2009/08/14/5 · Patch
• https://errata.altlinux.org/ALT-PU-2016-1079 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-5081 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5078 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-5081 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10031-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5080 · Security Note
• http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/groff/groff-1.20.1-owl-tmp.diff · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-5081 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-5081 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2013:086 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5081 · Security Note
• http://openwall.com/lists/oss-security/2009/08/14/4 · Patch
• https://bdu.fstec.ru/vul/2015-09687 · Security Note