Vulnerability Name:

CVE-2004-0372 (CCN-15564)

Assigned:2004-03-20
Published:2004-03-20
Updated:2017-07-11
Summary:xine allows local users to overwrite arbitrary files via a symlink attack on a bug report email that is generated by the (1) xine-bugreport or (2) xine-check scripts.
CVSS v3 Severity:4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
2.6 Low (CCN CVSS v2 Vector: AV:L/AC:H/Au:N/C:N/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:File Manipulation
References:Source: CCN
Type: BugTraq Mailing List, Sat Mar 20 2004 - 16:09:56 CST
xine-check/xine-bugreport symlink vulnerability.

Source: MITRE
Type: CNA
CVE-2004-0372

Source: BUGTRAQ
Type: UNKNOWN
20040320 xine-check/xine-bugreport symlink vulnerability.

Source: GENTOO
Type: UNKNOWN
GLSA-200404-20

Source: DEBIAN
Type: Patch, Vendor Advisory
DSA-477

Source: DEBIAN
Type: DSA-477
xine-ui -- insecure temporary file creation

Source: CCN
Type: GLSA-200404-20
Multiple vulnerabilities in xine

Source: CCN
Type: OSVDB ID: 4515
Xine Insecure Temporary File Creation

Source: BID
Type: Vendor Advisory
9939

Source: CCN
Type: BID-9939
Xine Bug Reporting Script Insecure Temporary File Creation Vulnerability

Source: XF
Type: UNKNOWN
xine-xinebugreport-xinecheck-symlink(15564)

Source: XF
Type: UNKNOWN
xine-xinebugreport-xinecheck-symlink(15564)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:xine:xine:0.9.13:*:*:*:*:*:*:*
  • OR cpe:/a:xine:xine:1_beta1:*:*:*:*:*:*:*
  • OR cpe:/a:xine:xine:1_beta2:*:*:*:*:*:*:*
  • OR cpe:/a:xine:xine:1_beta3:*:*:*:*:*:*:*
  • OR cpe:/a:xine:xine:1_beta4:*:*:*:*:*:*:*
  • OR cpe:/a:xine:xine:1_beta5:*:*:*:*:*:*:*
  • OR cpe:/a:xine:xine:1_beta6:*:*:*:*:*:*:*
  • OR cpe:/a:xine:xine:1_beta7:*:*:*:*:*:*:*
  • OR cpe:/a:xine:xine:1_beta8:*:*:*:*:*:*:*
  • OR cpe:/a:xine:xine:1_beta9:*:*:*:*:*:*:*
  • OR cpe:/a:xine:xine:1_beta10:*:*:*:*:*:*:*
  • OR cpe:/a:xine:xine:1_beta11:*:*:*:*:*:*:*
  • OR cpe:/a:xine:xine:1_beta12:*:*:*:*:*:*:*
  • OR cpe:/a:xine:xine:1_rc0a:*:*:*:*:*:*:*
  • OR cpe:/a:xine:xine:1_rc1:*:*:*:*:*:*:*
  • OR cpe:/a:xine:xine:1_rc2:*:*:*:*:*:*:*
  • OR cpe:/a:xine:xine:1_rc3:*:*:*:*:*:*:*
  • OR cpe:/a:xine:xine:1_rc3a:*:*:*:*:*:*:*
  • OR cpe:/a:xine:xine:1_rc3b:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:xine:xine-lib:0.9.13:*:*:*:*:*:*:*
  • AND
  • cpe:/o:debian:debian_linux:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:9.2:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:9.2::amd64:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.debian:def:477
    V
    		insecure temporary file creation
    2004-04-06
    BACK
    xine xine 0.9.13
    xine xine 1_beta1
    xine xine 1_beta2
    xine xine 1_beta3
    xine xine 1_beta4
    xine xine 1_beta5
    xine xine 1_beta6
    xine xine 1_beta7
    xine xine 1_beta8
    xine xine 1_beta9
    xine xine 1_beta10
    xine xine 1_beta11
    xine xine 1_beta12
    xine xine 1_rc0a
    xine xine 1_rc1
    xine xine 1_rc2
    xine xine 1_rc3
    xine xine 1_rc3a
    xine xine 1_rc3b
    xine xine-lib 0.9.13
    debian debian linux 3.0
    gentoo linux *
    mandrakesoft mandrake linux 9.2
    mandrakesoft mandrake linux 10.0
    mandrakesoft mandrake linux 9.2