Trustix developers discovered insecure temporary file creation in a supplemental script (der_chop) of the openssl package which may allow local users to overwrite files via a symlink attack.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:476 advisory.

  - security flaw (CVE-2004-0975, CVE-2005-0109)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200411-15 (OpenSSL, Groff: Insecure tempfile handling)

    groffer and the der_chop script create temporary files in     world-writeable directories with predictable names.
  Impact :

    A local attacker could create symbolic links in the temporary files     directory, pointing to a valid file somewhere on the filesystem. When     groffer or der_chop is executed, this would result in the file being     overwritten with the rights of the user running the utility, which     could be the root user.
  Workaround :

    There is no known workaround at this time.

リモートホストにインストールされている OpenSSL は、0.9.7f より前のバージョンです。したがって、0.9.7f のアドバイザリに記載されている脆弱性の影響を受けます。

  - Trustix Secure Linux 1.5 から 2.1 およびその他のオペレーティングシステムの openssl パッケージの der_chop スクリプトにより、ローカルユーザーが、一時ファイルのシンボリックリンク攻撃を介してファイルを上書きする可能性があります。(CVE-2004-0975)

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

遠端主機上安裝的 OpenSSL 為 0.9.7f 之前版本。因此，它會受到 0.9.7f 公告中提及的一個弱點影響。

  - 在 Trustix Secure Linux 1.5 至 2.1 (含) 及其他作業系統中，openssl 套件的 der_chop 指令碼允許本機使用者對暫存檔發動符號連結攻擊，藉此覆寫檔案。(CVE-2004-0975)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

The version of OpenSSL installed on the remote host is prior to 0.9.7f. It is, therefore, affected by a vulnerability as referenced in the 0.9.7f advisory.

  - The der_chop script in the openssl package in Trustix Secure Linux 1.5 through 2.1 and other operating     systems allows local users to overwrite files via a symlink attack on temporary files. (CVE-2004-0975)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Trustix developers found that the der_chop script, included in the openssl package, created temporary files insecurely. This could allow local users to overwrite files using a symlink attack.

The updated packages have been patched to prevent this problem.

远程主机上安装的 OpenSSL 版本低于 0.9.7f。因此，该应用程序受到 0.9.7f 公告中提及的漏洞的影响。

  - 在 Trustix Secure Linux 1.5 至 2.1 以及其他操作系统中，openssl 程序包中的 der_chop 脚本允许本地用户通过对临时文件进行符号链接攻击来覆盖文件。(CVE-2004-0975)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

Recently, Trustix Secure Linux discovered a vulnerability in the openssl package. The auxiliary script 'der_chop' created temporary files in an insecure way, which could allow a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated OpenSSL packages that fix security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

OpenSSL is a toolkit that implements Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library.

Colin Percival reported a cache timing attack that could allow a malicious local user to gain portions of cryptographic keys. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2005-0109 to the issue. The OpenSSL library has been patched to add a new fixed-window mod_exp implementation as default for RSA, DSA, and DH private-key operations. This patch is designed to mitigate cache timing and potentially related attacks.

A flaw was found in the way the der_chop script creates temporary files. It is possible that a malicious local user could cause der_chop to overwrite files (CVE-2004-0975). The der_chop script was deprecated and has been removed from these updated packages. Red Hat Enterprise Linux 4 did not ship der_chop and is therefore not vulnerable to this issue.

Users are advised to update to these erratum packages which contain patches to correct these issues.

Please note: After installing this update, users are advised to either restart all services that use OpenSSL or restart their system.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
15893	Debian DSA-603-1 : openssl - insecure temporary file	Nessus	Debian Local Security Checks	2004/12/1	2021/1/4	low
18409	RHEL 4 : openssl (RHSA-2005:476)	Nessus	Red Hat Local Security Checks	2005/6/2	2024/4/27	medium
15649	GLSA-200411-15 : OpenSSL, Groff: Insecure tempfile handling	Nessus	Gentoo Local Security Checks	2004/11/8	2021/1/6	low
17754	OpenSSL 0.9.7 < 0.9.7f の脆弱性	Nessus	Web Servers	2012/1/4	2024/6/7	medium
17754	OpenSSL 0.9.7 < 0.9.7f 弱點	Nessus	Web Servers	2012/1/4	2024/6/7	medium
17754	OpenSSL 0.9.7 < 0.9.7f Vulnerability	Nessus	Web Servers	2012/1/4	2024/6/7	medium
15920	Mandrake Linux Security Advisory : openssl (MDKSA-2004:147)	Nessus	Mandriva Local Security Checks	2004/12/7	2021/1/6	low
17754	OpenSSL 0.9.7 < 0.9.7f 漏洞	Nessus	Web Servers	2012/1/4	2024/6/7	medium
20639	Ubuntu 4.10 : openssl script vulnerability (USN-24-1)	Nessus	Ubuntu Local Security Checks	2006/1/15	2021/1/19	low
21830	CentOS 3 / 4 : openssl (CESA-2005:476)	Nessus	CentOS Local Security Checks	2006/7/3	2021/1/4	medium

検出

プラグインの検索

low

medium

low

medium

medium

medium

low

medium

low

medium