xmFrot contains a flaw that may allow a malicious local user to perform certain actions with escalated privileges. The issue is caused by temporary files being created insecurely by default which can be exploited via symlink attacks. It is possible that the flaw may allow an attacker to create or overwrite arbitrary files with privileges of the user running wmFrog resulting in a loss of integrity.
Classification
Location:
Local Access Required
Attack Type:
Race Condition
Impact:
Loss of Integrity
Exploit:
Exploit Unknown
Disclosure:
OSVDB Verified
Solution
Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workarounds: 1.) Use the "-tmp" command line option to specify a secure temporary directory. 2.) Grant only trusted users access to affected systems.
This product uses the Daylife API but is not endorsed or certified by Daylife.
This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.
