GNU GetText未指定的不安全临时文件创建漏洞

漏洞信息详情

GNU GetText未指定的不安全临时文件创建漏洞

• CNNVD编号：CNNVD-200502-037
• 危害等级： 低危
  
  
• CVE编号：
  CVE-2004-0966
  
• 漏洞类型：
  
  
  设计错误
  
• 发布时间：
  
  2005-02-09
  
• 威胁类型：
  
  
  本地
  
• 更新时间：
  
  2005-10-20
  
• 厂        商：
  
  ubuntu
• 漏洞来源：
  The individual or …

Gettext 用于系统的国际化(I18N)和本地化(L10N)，可以在编译程序的时候使用本国语言支持(Native Language Support(NLS))，其可以使程序的输出使用用户设置的语言而不是英文。
GNU gettext程序包1.14及更高版本中的(1) autopoint和(2) gettextize脚本，用在Trustix Secure Linux 1.5至2.1以及其他操作系统中，可让本地用户通过象征性的链接攻击临时文件，从而覆盖这些文件。

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接：
GNU gettext 0.13.1
Mandriva gettext-0.13.1-1.3.C30mdk.i586.rpm
Corporate 3.0:
http://www.mandriva.com/en/download
Mandriva gettext-0.13.1-1.3.C30mdk.src.rpm
Corporate 3.0:
http://www.mandriva.com/en/download
Mandriva gettext-0.13.1-1.3.C30mdk.x86_64.rpm
Corporate 3.0:
http://www.mandriva.com/en/download
Mandriva gettext-base-0.13.1-1.3.C30mdk.i586.rpm
Corporate 3.0:
http://www.mandriva.com/en/download
Mandriva gettext-base-0.13.1-1.3.C30mdk.x86_64.rpm
Corporate 3.0:
http://www.mandriva.com/en/download
Mandriva gettext-devel-0.13.1-1.3.C30mdk.i586.rpm
Corporate 3.0:
http://www.mandriva.com/en/download
Mandriva gettext-devel-0.13.1-1.3.C30mdk.x86_64.rpm
Corporate 3.0:
http://www.mandriva.com/en/download
Mandriva gettext-java-0.13.1-1.3.C30mdk.i586.rpm
Corporate 3.0:
http://www.mandriva.com/en/download
Mandriva gettext-java-0.13.1-1.3.C30mdk.x86_64.rpm
Corporate 3.0:
http://www.mandriva.com/en/download
Mandriva lib64gettextmisc-0.13.1-1.3.C30mdk.x86_64.rpm
Corporate 3.0:
http://www.mandriva.com/en/download
Mandriva lib64intl2-0.13.1-1.3.C30mdk.x86_64.rpm
Corporate 3.0:
http://www.mandriva.com/en/download
Mandriva libgettextmisc-0.13.1-1.3.C30mdk.i586.rpm
Corporate 3.0:
http://www.mandriva.com/en/download
Mandriva libintl2-0.13.1-1.3.C30mdk.i586.rpm
Corporate 3.0:
http://www.mandriva.com/en/download
Ubuntu gettext-base_0.14.1-2ubuntu0.1_amd64.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext-base_0.1 4.1-2ubuntu0.1_amd64.deb
Ubuntu gettext-base_0.14.1-2ubuntu0.1_i386.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext-base_0.1 4.1-2ubuntu0.1_i386.deb
Ubuntu gettext-base_0.14.1-2ubuntu0.1_powerpc.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext-base_0.1 4.1-2ubuntu0.1_powerpc.deb
Ubuntu gettext-doc_0.14.1-2ubuntu0.1_all.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext-doc_0.14 .1-2ubuntu0.1_all.deb
Ubuntu gettext-el_0.14.1-2ubuntu0.1_all.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext-el_0.14. 1-2ubuntu0.1_all.deb
Ubuntu gettext_0.14.1-2ubuntu0.1_amd64.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext_0.14.1-2 ubuntu0.1_amd64.deb
Ubuntu gettext_0.14.1-2ubuntu0.1_i386.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext_0.14.1-2 ubuntu0.1_i386.deb
Ubuntu gettext_0.14.1-2ubuntu0.1_powerpc.deb
Ubuntu 4.10 (Warty Warthog)
http://security.ubuntu.com/ubuntu/pool/main/g/gettext/gettext_0.14.1-2 ubuntu0.1_powerpc.deb
GNU gettext 0.14.1
Trustix gettext-0.14.1-4tr.i586.rpm
Trustix Secure Linux 2.1 & Enterprise Server 2
ftp://ftp.trustix.org/pub/trustix/updates/

来源: BID
名称: 11282
链接:http://www.securityfocus.com/bid/11282

来源: XF
名称: script-temporary-file-overwrite(17583)
链接:http://xforce.iss.net/xforce/xfdb/17583

来源: TRUSTIX
名称: 2004-0050
链接:http://www.trustix.org/errata/2004/0050

来源: GENTOO
名称: GLSA-200410-10
链接:http://www.gentoo.org/security/en/glsa/glsa-200410-10.xml

来源: bugzilla.redhat.com
链接:http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=136323

来源: MANDRIVA
名称: MDKSA-2006:051
链接:http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2006:051

来源: FEDORA
名称: FLSA:136323
链接:http://www.redhat.com/archives/fedora-legacy-announce/2006-January/msg00000.html

来源: OPENPKG
名称: OpenPKG-SA-2004.055
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=110382652226638&w=2

来源: UBUNTU
名称: USN-5-1
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109899973325734&w=2