Vulnerability Name:

CVE-2004-1377 (CCN-18671)

Assigned:2004-12-27
Published:2004-12-27
Updated:2017-07-11
Summary:The (1) fixps (aka fixps.in) and (2) psmandup (aka psmandup.in) scripts in a2ps before 4.13 allow local users to overwrite arbitrary files via a symlink attack on temporary files.
CVSS v3 Severity:4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
2.6 Low (CCN CVSS v2 Vector: AV:L/AC:H/Au:N/C:N/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:File Manipulation
References:Source: MITRE
Type: CNA
CVE-2004-1377

Source: CCN
Type: SA13641
GNU a2ps Two Scripts Insecure Temporary File Creation

Source: SECUNIA
Type: Vendor Advisory
13641

Source: CCN
Type: GLSA-200501-02
a2ps: Multiple vulnerabilities

Source: GENTOO
Type: Patch
GLSA-200501-02

Source: CCN
Type: GNU a2ps Web page
a2ps - GNU Project - Free Software Foundation (FSF)

Source: CCN
Type: OSVDB ID: 12844
GNU a2ps fixps Script Symlink Arbitrary File Overwrite

Source: CCN
Type: OSVDB ID: 12845
GNU a2ps psmandup Script Symlink Arbitrary File Overwrite

Source: BID
Type: Patch
12108

Source: CCN
Type: BID-12108
GNU A2PS fixps.in Script Insecure Temporary File Vulnerability

Source: BID
Type: Patch
12109

Source: CCN
Type: BID-12109
GNU A2PS psmandup.in Script Insecure Temporary File Vulnerability

Source: CCN
Type: TLSA-2005-64
Symlink attack in a2ps

Source: CONFIRM
Type: UNKNOWN
http://www.vuxml.org/freebsd/9168253c-5a6d-11d9-a9e7-0001020eed82.html

Source: XF
Type: UNKNOWN
gnu-a2ps-fixpsin-symlink(18671)

Source: XF
Type: UNKNOWN
gnu-a2ps-fixpsin-symlink(18671)

Source: XF
Type: UNKNOWN
gnu-a2ps-psmanupin-symlink(18672)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:gnu:a2ps:4.13:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:a2ps:4.13b:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:turbolinux:turbolinux:*:*:home:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:7.0:*:*:*:server:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:8.0:*:*:*:server:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:7.0:*:*:*:workstation:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:8.0:*:*:*:workstation:*:*:*

    • Configuration CCN 1:
  • cpe:/a:gnu:a2ps:4.13b:*:*:*:*:*:*:*
  • AND
  • cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.1::x86-64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:*:*:home:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1::x86_64:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20041377
    V
    		CVE-2004-1377
    2022-06-30
    oval:org.opensuse.security:def:111917
    P
    		a2ps-4.14-6.6 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:105485
    P
    		a2ps-4.14-6.6 on GA media (Moderate)
    2021-10-01
    BACK
    gnu a2ps 4.13
    gnu a2ps 4.13b
    turbolinux turbolinux home *
    turbolinux turbolinux server 7.0
    turbolinux turbolinux server 8.0
    turbolinux turbolinux workstation 7.0
    turbolinux turbolinux workstation 8.0
    gnu a2ps 4.13b
    gentoo linux *
    mandrakesoft mandrake linux corporate server 2.1
    mandrakesoft mandrake linux 10.1
    mandrakesoft mandrake linux corporate server 3.0
    mandrakesoft mandrake linux 10.1
    mandrakesoft mandrake linux corporate server 3.0
    turbolinux turbolinux home *
    mandrakesoft mandrake linux corporate server 2.1