The der_chop script in the openssl package in Trustix Secure Linux 1.5 through 2.1 and other operating systems allows local users to overwrite files via a symlink attack on temporary files.

The version of OpenSSL installed on the remote host is prior to 0.9.7f. It is, therefore, affected by a vulnerability as referenced in the 0.9.7f advisory.

  - The der_chop script in the openssl package in Trustix Secure Linux 1.5 through 2.1 and other operating     systems allows local users to overwrite files via a symlink attack on temporary files. (CVE-2004-0975)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated OpenSSL packages that fix security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

OpenSSL is a toolkit that implements Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library.

Colin Percival reported a cache timing attack that could allow a malicious local user to gain portions of cryptographic keys. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2005-0109 to the issue. The OpenSSL library has been patched to add a new fixed-window mod_exp implementation as default for RSA, DSA, and DH private-key operations. This patch is designed to mitigate cache timing and potentially related attacks.

A flaw was found in the way the der_chop script creates temporary files. It is possible that a malicious local user could cause der_chop to overwrite files (CVE-2004-0975). The der_chop script was deprecated and has been removed from these updated packages. Red Hat Enterprise Linux 4 did not ship der_chop and is therefore not vulnerable to this issue.

Users are advised to update to these erratum packages which contain patches to correct these issues.

Please note: After installing this update, users are advised to either restart all services that use OpenSSL or restart their system.

Recently, Trustix Secure Linux discovered a vulnerability in the openssl package. The auxiliary script 'der_chop' created temporary files in an insecure way, which could allow a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:476 advisory.

    OpenSSL is a toolkit that implements Secure Sockets Layer (SSL v2/v3) and     Transport Layer Security (TLS v1) protocols as well as a full-strength     general purpose cryptography library.

    Colin Percival reported a cache timing attack that could allow a malicious     local user to gain portions of cryptographic keys.  The Common     Vulnerabilities and Exposures project (cve.mitre.org) assigned the name     CAN-2005-0109 to the issue.  The OpenSSL library has been patched to add a     new fixed-window mod_exp implementation as default for RSA, DSA, and DH     private-key operations.  This patch is designed to mitigate cache timing     and potentially related attacks.

    A flaw was found in the way the der_chop script creates temporary files. It     is possible that a malicious local user could cause der_chop to overwrite     files (CAN-2004-0975).  The der_chop script was deprecated and has been     removed from these updated packages.  Red Hat Enterprise Linux 4 did not     ship der_chop and is therefore not vulnerable to this issue.

    Users are advised to update to these erratum packages which contain patches     to correct these issues.

    Please note: After installing this update, users are advised to either     restart all services that use OpenSSL or restart their system.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Trustix developers found that the der_chop script, included in the openssl package, created temporary files insecurely. This could allow local users to overwrite files using a symlink attack.

The updated packages have been patched to prevent this problem.

Trustix developers discovered insecure temporary file creation in a supplemental script (der_chop) of the openssl package which may allow local users to overwrite files via a symlink attack.

The remote host is affected by the vulnerability described in GLSA-200411-15 (OpenSSL, Groff: Insecure tempfile handling)

    groffer and the der_chop script create temporary files in     world-writeable directories with predictable names.
  Impact :

    A local attacker could create symbolic links in the temporary files     directory, pointing to a valid file somewhere on the filesystem. When     groffer or der_chop is executed, this would result in the file being     overwritten with the rights of the user running the utility, which     could be the root user.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
17754	OpenSSL 0.9.7 < 0.9.7f Vulnerability	Nessus	Web Servers	medium
21830	CentOS 3 / 4 : openssl (CESA-2005:476)	Nessus	CentOS Local Security Checks	medium
20639	Ubuntu 4.10 : openssl script vulnerability (USN-24-1)	Nessus	Ubuntu Local Security Checks	low
18409	RHEL 4 : openssl (RHSA-2005:476)	Nessus	Red Hat Local Security Checks	medium
15920	Mandrake Linux Security Advisory : openssl (MDKSA-2004:147)	Nessus	Mandriva Local Security Checks	low
15893	Debian DSA-603-1 : openssl - insecure temporary file	Nessus	Debian Local Security Checks	low
15649	GLSA-200411-15 : OpenSSL, Groff: Insecure tempfile handling	Nessus	Gentoo Local Security Checks	low

Detections

Analytics

CVE-2004-0975

medium

Tenable Plugins

medium

medium

low

medium

low

low

low