xferfaxstats in HylaFax 4.2.1 and earlier allows local users to overwrite arbitrary files via a symlink attack on the xferfax$$ temporary file.

Javier Fernandez-Sanguino Pena discovered that several scripts of the hylafax suite, a flexible client/server fax software, create temporary files and directories in an insecure fashion, leaving them vulnerable to symlink exploits.

faxcron, recvstats, and xferfaxstats in HylaFax 4.2.1 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files. (CVE-2005-3069)

In addition, HylaFax has some provisional support for Unix domain sockets, which is disabled in the default compile configuration. It is suspected that a local user could create a fake /tmp/hyla.unix socket and intercept fax traffic via this socket. In testing for this vulnerability, with CONFIG_UNIXTRANSPORT disabled, it has been found that client programs correctly exit before sending any data.
(CVE-2005-3070)

The updated packages have been patched to correct these issues.

The remote host is affected by the vulnerability described in GLSA-200509-21 (Hylafax: Insecure temporary file creation in xferfaxstats script)

    Javier Fernandez-Sanguino has discovered that xferfaxstats cron script     supplied by Hylafax insecurely creates temporary files with predictable     filenames.
  Impact :

    A local attacker could create symbolic links in the temporary file     directory, pointing to a valid file somewhere on the filesystem. When     the xferfaxstats script of Hylafax is executed, this would result in     the file being overwritten with the rights of the user running the     script, which typically is the root user.
  Workaround :

    There is no known workaround at this time.

The remote host is running HylaFAX, a fax transmission software. It is reported that HylaFAX is prone to a flaw in the way that it creates temporary files.  A local attacker exploiting this flaw would be able to gain access to potentially confidential information or use the flaw to escalate their privileges on the machine.

ID	Name	Product	Family	Severity
20020	Debian DSA-865-1 : hylafax - insecure temporary files	Nessus	Debian Local Security Checks	low
19985	Mandrake Linux Security Advisory : hylafax (MDKSA-2005:177)	Nessus	Mandriva Local Security Checks	low
19820	GLSA-200509-21 : Hylafax: Insecure temporary file creation in xferfaxstats script	Nessus	Gentoo Local Security Checks	low
3236	HylaFAX < 4.2.2 RC1 xferfaxstats Symlink Arbitrary File Overwrite	Nessus Network Monitor	Generic	medium

Detections

Analytics

CVE-2005-3069

medium

Tenable Plugins

low

low

low

medium