CVE-2016-9595
27.07.2018, 18:29
A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.
| Vendor | Product | Version |
|---|---|---|
| theforeman | katello | 𝑥 < 3.4.0 |
| redhat | satellite | 6.3 |
| redhat | satellite_capsule | 6.3 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-377 - Insecure Temporary FileCreating and using insecure temporary files can leave application and system data vulnerable to attack.
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.