National Vulnerability Database (CVE-2004-0975)

National Cyber-Alert System Vulnerability Summary: CVE-2004-0975
Orirignal release date: 2005-02-09 Source: US-CERT/NIST ### Overview The der_chop script in the openssl package in Trustix Secure Linux 1.5 through 2.1 and other operating systems allows local users to overwrite files via a symlink attack on temporary files. ### Impact CVSS Severity: 2.3 (Low) Range: local Authentication: design Impact Type: int ### Reference to Advisories, Solutions, and Tools External Source: Security Focus Name: OpenSSL DER_CHOP Insecure Temporary File Creation Vulnerability Hyperlink: http://www.securityfocus.com/bid/11293 External Source: ISS X-Force Name: Multiple scripts temporary file overwrite Hyperlink: http://xforce.iss.net/xforce/xfdb/17583 External Source: DEBIAN Name: DSA-603 Hyperlink: http://www.debian.org/security/2004/dsa-603 External Source: GENTOO Name: GLSA-200411-15 Hyperlink: http://www.gentoo.org/security/en/glsa/glsa-200411-15.xml External Source: TRUSTIX Name: 2004-0050 Hyperlink: http://www.trustix.org/errata/2004/0050 External Source: CONFIRM Name: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=136302 Hyperlink: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=136302 External Source: SECUNIA Name: 12973 Hyperlink: http://secunia.com/advisories/12973 External Source: OVAL Name: OVAL164 Hyperlink: http://oval.mitre.org/oval/definitions/data/oval164.html ### Vulnerable Software and Vendor OpenSSL (OpenSSL Project) Mandrake Corporate Server (MandrakeSoft) Mandrake Multi Network Firewall (MandrakeSoft) Gentoo Linux (Gentoo) Mandrake Linux (MandrakeSoft) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0975