Symlink Attack Vulnerability in Gnash by Gnash Project
CVE-2010-4337

Currently unrated

Key Information:

Vendor

Gnu
Status
Gnash
Vendor
CVE Published:
14 January 2011

What is CVE-2010-4337?

In Gnash version 0.8.8, the configuration script is susceptible to a symlink attack, allowing local users to overwrite arbitrary files. This vulnerability occurs due to insufficient checks on temporary files created during the configuration process, specifically the /tmp/gnash-configure-errors.$$ and similar files. Malicious users can exploit this flaw, leading to potential data loss or system compromise by redirecting these temporary file paths to unintended locations.

References

http://www.securityfocus.com/bid/45102
vdb-entryx_refsource_BID
http://secunia.com/advisories/42416
third-party-advisoryx_refsource_SECUNIA
http://www.debian.org/security/2012/dsa-2435
vendor-advisoryx_refsource_DEBIAN

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2010-4337 : Symlink Attack Vulnerability in Gnash by Gnash Project