Bug 716367 (CVE-2011-3351) - VUL-1: CVE-2011-3351: openvas-scanner: Insecure temporary file use
Summary: VUL-1: CVE-2011-3351: openvas-scanner: Insecure temporary file use
Status: NEW
Alias: CVE-2011-3351
Product: SUSE Security Incidents
Classification: Novell Products
Component: General (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Normal
Target Milestone: ---
Assignee: Adam Majer
QA Contact: Security Team bot
URL:
Whiteboard: maint:planned:update
Keywords:
Depends on:
Blocks:
 
Reported: 2011-09-07 12:55 UTC by Ludwig Nussel
Modified: 2018-10-30 15:18 UTC (History)
3 users (show)

See Also:
Found By: Other
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Ludwig Nussel 2011-09-07 12:55:28 UTC
Your friendly security team received the following report via oss-security.
Please respond ASAP.
The issue is public.

------------------------------------------------------------------------------
Date: Wed, 07 Sep 2011 14:13:45 +0200
From: Jan Lieskovsky <jlieskov@redhat.com>
Subject: [oss-security] CVE Request -- openvas-scanner -- Insecure temporary file use by
 generation of an OVAL system characteristics document, when ovaldi support
 enabled

Hello Josh, Steve, vendors,

   it was reported that the scanner module for the Open Vulnerability
Assessment System (OpenVAS) used insecure way for creation of a
temporary file, when generating OVAL system characteristics document
from the knowledge base data available, with the ovaldi integrated tool
enabled. A local attacker could use this flaw to conduct symlink
attacks to overwrite arbitrary files on the system, accessible with the
privileges of the user running the SLAD daemon and / or the ovaldi OVAL
interpreter.

References:
[1] http://archives.neohapsis.com/archives/fulldisclosure/2011-09/0057.html
[2] http://secunia.com/advisories/45836/
[3] https://bugzilla.redhat.com/show_bug.cgi?id=736317

Could you allocate a CVE id for this?

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team
Comment 1 Ludwig Nussel 2011-09-08 10:51:26 UTC
Upstream response:
http://seclists.org/openvas/2011/q3/233
Comment 2 Sebastian Krahmer 2011-09-12 07:10:21 UTC
CVE-2011-3351