A programming error was found in id3lib by Nikolaus Schulz that could lead to a denial of service through symlink attacks.

Updated packages have been patched to prevent these issues.

This update fixes a bug that allows local attackers to overwrite arbitrary files. (CVE-2007-4460)

リモートの Solaris システムに、次のセキュリティの更新に対処するのに必要なパッチがありません：

- id3lib (aka libid3) 3.8.3 中の itag_file.cpp のRenderV2ToFile 関数は、タグ付けされているファイルの名前から名前を作成されたテンポラリファイル上のシンボリックリンク攻撃を介して、ローカルユーザーが任意のファイルを上書きする可能性があります。(CVE-2007-4460)

- 0.22.1 より前の poppler は、(1) splash/Splash.cc、(2) poppler/Function.cc と (3) poppler/Stream.cc で「無効なメモリアクセス」を引き起こすベクトルを介して、コンテキスト依存の攻撃者が、サービス拒否（クラッシュ）を起こして任意のコードを実行することを可能にします。
 (CVE-2013-1788)

- 0.22.1 より前の poppler の splash/Splash.cc は、(1) Splash::arbitraryTransformMask、(2) Splash::blitMask　と (3) Splash::scaleMaskYuXu 関数に関連するベクトルを介してコンテキスト依存の攻撃者が、サービス拒否（NULL ポインターデリファレンスとクラッシュ）を引き起こすことを可能にします。(CVE-2013-1789)

- 0.22.1 より前の poppler/Stream.cc は、 CCITTFaxStream::lookChar 関数による初期化されていないメモリの読み取りを引き起こすベクトルを介して、コンテキスト依存の攻撃者が、特定できない影響を引き起こすことを可能にします。
 (CVE-2013-1790)

The remote Solaris system is missing necessary patches to address security updates :

  - The RenderV2ToFile function in tag_file.cpp in id3lib     (aka libid3) 3.8.3 allows local users to overwrite     arbitrary files via a symlink attack on a temporary file     whose name is constructed from the name of a file being     tagged. (CVE-2007-4460)

  - poppler before 0.22.1 allows context-dependent attackers     to cause a denial of service (crash) and possibly     execute arbitrary code via vectors that trigger an     'invalid memory access' in (1) splash/Splash.cc, (2)     poppler/Function.cc, and (3) poppler/Stream.cc.
    (CVE-2013-1788)

  - splash/Splash.cc in poppler before 0.22.1 allows     context-dependent attackers to cause a denial of service     (NULL pointer dereference and crash) via vectors related     to the (1) Splash::arbitraryTransformMask, (2)     Splash::blitMask, and (3) Splash::scaleMaskYuXu     functions. (CVE-2013-1789)

  - poppler/Stream.cc in poppler before 0.22.1 allows     context-dependent attackers to have an unspecified     impact via vectors that trigger a read of uninitialized     memory by the CCITTFaxStream::lookChar function.
    (CVE-2013-1790)

Debian Bug report log reports :

When tagging file $foo, a temporary copy of the file is created, and for some reason, libid3 doesn't use mkstemp but just creates $foo.XXXXXX literally, without any checking.

This would silently truncate and overwrite an existing $foo.XXXXXX.

远程 Solaris 系统缺少用于处理安全更新的必要修补程序：

- id3lib (aka libid3) 3.8.3 的 tag_file.cpp 中的 RenderV2ToFile 函数允许本地用户通过针对特定临时文件（其名称根据标记的文件的名称创建）的符号链接攻击来覆盖任意文件。(CVE-2007-4460)

- 0.22.1 之前的 Poppler 允许上下文有关的攻击者通过会在 (1) splash/Splash.cc、(2) poppler/Function.cc 和 (3) poppler/Stream.cc 中触发“无效内存访问”的矢量来造成拒绝服务（崩溃），甚至可能导致执行任意代码。
 (CVE-2013-1788)

- 0.22.1 之前的 Poppler 中的 splash/Splash.cc 允许上下文有关的攻击者通过与 (1) Splash::arbitraryTransformMask、(2) Splash::blitMask 和 (3) Splash::scaleMaskYuXu 函数相关的矢量来造成拒绝服务（空指针取消引用和崩溃）。(CVE-2013-1789)

- 0.22.1 之前的 Poppler 中的 poppler/Stream.cc 允许上下文有关的攻击者通过由 CCITTFaxStream::lookChar 函数触发读取未初始化的内存的矢量来造成不明影响。
 (CVE-2013-1790)

遠端 Solaris 系統缺少處理安全性更新的必要修補程式：

- 在 id3lib (aka libid3) 3.8.3 的 tag_file.cpp 中，RenderV2ToFile 函式可讓本機使用者透過從要標註之檔案的名稱建構其名稱的暫存檔上的符號連結攻擊覆寫任意檔案。(CVE-2007-4460)

- 0.22.1 之前的 poppler 可讓內容相依的攻擊者造成拒絕服務 (當機)，而且可能會在 (1) splash/Splash.cc、(2) poppler/Function.cc 和 (3) poppler/Stream.cc 中，透過可觸發「無效記憶體存取」的向量，執行任意程式碼。
 (CVE-2013-1788)

- 0.22.1 之前的 poppler 中的 splash/Splash.cc 可讓內容相依的攻擊者透過與 (1) Splash::arbitraryTransformMask、(2) Splash::blitMask 和 (3) Splash::scaleMaskYuXu 函式相關的向量，造成拒絕服務 (NULL 指標解除參照和當機)。(CVE-2013-1789)

- 0.22.1 之前的 poppler 中的 poppler/Stream.cc 可讓內容相依的攻擊者透過可觸發 CCITTFaxStream::lookChar 函式讀取未初始化記憶體的向量，造成不明影響。
 (CVE-2013-1790)

Nikolaus Schulz discovered that a programming error in id3lib, an ID3 Tag Library, may lead to denial of service through symlink attacks.

The remote host is affected by the vulnerability described in GLSA-200709-08 (id3lib: Insecure temporary file creation)

    Nikolaus Schulz discovered that the function RenderV2ToFile() in file     src/tag_file.cpp creates temporary files in an insecure manner.
  Impact :

    A local attacker could exploit this vulnerability via a symlink attack     to overwrite arbitrary files.
  Workaround :

    There is no known workaround at this time.

This security update fixes a (minor) tempfile creation security issue (CVE-2007-4460) by using mkstemp (bugzilla 253553)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
26047	Mandrake Linux Security Advisory : id3lib (MDKSA-2007:180)	Nessus	Mandriva Local Security Checks	2007/9/14	2021/1/6	high
29462	SuSE 10 Security Update : id3lib (ZYPP Patch Number 4317)	Nessus	SuSE Local Security Checks	2007/12/13	2021/1/14	high
80625	Oracle Solaris サードパーティのパッチの更新：gnome（cve_2007_4460_symlink_attack）	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	high
80625	Oracle Solaris Third-Party Patch Update : gnome (cve_2007_4460_symlink_attack)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	high
27269	openSUSE 10 Security Update : id3lib (id3lib-4316)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	high
41150	SuSE9 Security Update : id3lib (YOU Patch Number 11786)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
26212	FreeBSD : id3lib -- insecure temporary file creation (15ec9123-7061-11dc-b372-001921ab2fa4)	Nessus	FreeBSD Local Security Checks	2007/10/3	2021/1/6	high
80625	Oracle Solaris 第三方修补程序更新：gnome (cve_2007_4460_symlink_attack)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	high
80625	Oracle Solaris 第三方修補程式更新：gnome (cve_2007_4460_symlink_attack)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	high
25965	Debian DSA-1365-3 : id3lib3.8.3 - programming error	Nessus	Debian Local Security Checks	2007/9/3	2021/1/4	high
26098	GLSA-200709-08 : id3lib: Insecure temporary file creation	Nessus	Gentoo Local Security Checks	2007/9/24	2021/1/6	high
27732	Fedora 7 : id3lib-3.8.3-17.fc7 (2007-1774)	Nessus	Fedora Local Security Checks	2007/11/6	2021/1/11	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high