漏洞信息详情

GNU GetText未指定的不安全临时文件创建漏洞

• CNNVD编号：CNNVD-200502-037
• 危害等级： 低危
  
• CVE编号： CVE-2004-0966
• 漏洞类型： 设计错误
• 发布时间： 2005-02-09
• 威胁类型： 本地
• 更新时间： 2005-10-20
• 厂        商： ubuntu
• 漏洞来源： The individual or ...

漏洞简介

Gettext 用于系统的国际化(I18N)和本地化(L10N)，可以在编译程序的时候使用本国语言支持(Native Language Support(NLS))，其可以使程序的输出使用用户设置的语言而不是英文。 GNU gettext程序包1.14及更高版本中的(1) autopoint和(2) gettextize脚本，用在Trustix Secure Linux 1.5至2.1以及其他操作系统中，可让本地用户通过象征性的链接攻击临时文件，从而覆盖这些文件。

漏洞公告

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接： GNU gettext 0.13.1 Mandriva gettext-0.13.1-1.3.C30mdk.i586.rpm Corporate 3.0: http://www.mandriva.com/en/download Mandriva gettext-0.13.1-1.3.C30mdk.src.rpm Corporate 3.0: http://www.mandriva.com/en/download Mandriva gettext-0.13.1-1.3.C30mdk.x86_64.rpm Corporate 3.0: http://www.mandriva.com/en/download Mandriva gettext-base-0.13.1-1.3.C30mdk.i586.rpm Corporate 3.0: http://www.mandriva.com/en/download Mandriva gettext-base-0.13.1-1.3.C30mdk.x86_64.rpm Corporate 3.0: http://www.mandriva.com/en/download Mandriva gettext-devel-0.13.1-1.3.C30mdk.i586.rpm Corporate 3.0: http://www.mandriva.com/en/download Mandriva gettext-devel-0.13.1-1.3.C30mdk.x86_64.rpm Corporate 3.0: http://www.mandriva.com/en/download Mandriva gettext-java-0.13.1-1.3.C30mdk.i586.rpm Corporate 3.0: http://www.mandriva.com/en/download Mandriva gettext-java-0.13.1-1.3.C30mdk.x86_64.rpm Corporate 3.0: http://www.mandriva.com/en/download Mandriva lib64gettextmisc-0.13.1-1.3.C30mdk.x86_64.rpm Corporate 3.0: http://www.mandriva.com/en/download Mandriva lib64intl2-0.13.1-1.3.C30mdk.x86_64.rpm Corporate 3.0: http://www.mandriva.com/en/download Mandriva libgettextmisc-0.13.1-1.3.C30mdk.i586.rpm Corporate 3.0: http://www.mandriva.com/en/download Mandriva libintl2-0.13.1-1.3.C30mdk.i586.rpm Corporate 3.0: http://www.mandriva.com/en/download Ubuntu gettext-base_0.14.1-2ubuntu0.1_amd64.deb Ubuntu 4.10 (Warty Warthog) http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext-base_0.1 4.1-2ubuntu0.1_amd64.deb Ubuntu gettext-base_0.14.1-2ubuntu0.1_i386.deb Ubuntu 4.10 (Warty Warthog) http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext-base_0.1 4.1-2ubuntu0.1_i386.deb Ubuntu gettext-base_0.14.1-2ubuntu0.1_powerpc.deb Ubuntu 4.10 (Warty Warthog) http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext-base_0.1 4.1-2ubuntu0.1_powerpc.deb Ubuntu gettext-doc_0.14.1-2ubuntu0.1_all.deb Ubuntu 4.10 (Warty Warthog) http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext-doc_0.14 .1-2ubuntu0.1_all.deb Ubuntu gettext-el_0.14.1-2ubuntu0.1_all.deb Ubuntu 4.10 (Warty Warthog) http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext-el_0.14. 1-2ubuntu0.1_all.deb Ubuntu gettext_0.14.1-2ubuntu0.1_amd64.deb Ubuntu 4.10 (Warty Warthog) http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext_0.14.1-2 ubuntu0.1_amd64.deb Ubuntu gettext_0.14.1-2ubuntu0.1_i386.deb Ubuntu 4.10 (Warty Warthog) http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext_0.14.1-2 ubuntu0.1_i386.deb Ubuntu gettext_0.14.1-2ubuntu0.1_powerpc.deb Ubuntu 4.10 (Warty Warthog) http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext_0.14.1-2 ubuntu0.1_powerpc.deb GNU gettext 0.14.1 Trustix gettext-0.14.1-4tr.i586.rpm Trustix Secure Linux 2.1 & Enterprise Server 2 ftp://ftp.trustix.org/pub/trustix/updates/

参考网址

来源: BID 名称: 11282 链接:http://www.securityfocus.com/bid/11282 来源: XF 名称: script-temporary-file-overwrite(17583) 链接:http://xforce.iss.net/xforce/xfdb/17583 来源: TRUSTIX 名称: 2004-0050 链接:http://www.trustix.org/errata/2004/0050 来源: GENTOO 名称: GLSA-200410-10 链接:http://www.gentoo.org/security/en/glsa/glsa-200410-10.xml 来源: bugzilla.redhat.com 链接:http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=136323 来源: MANDRIVA 名称: MDKSA-2006:051 链接:http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2006:051 来源: FEDORA 名称: FLSA:136323 链接:http://www.redhat.com/archives/fedora-legacy-announce/2006-January/msg00000.HTML 来源: OPENPKG 名称: OpenPKG-SA-2004.055 链接:http://marc.theaimsgroup.com/?l=bugtraq&m=110382652226638&w=2 来源: UBUNTU 名称: USN-5-1 链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109899973325734&w=2

受影响实体

• Ubuntu Ubuntu_linux:4.1:Ppc  
• Ubuntu Ubuntu_linux:4.1:Ia64  

补丁

暂无