hugin, as used on various operating systems including SUSE openSUSE 10.2 and 10.3, allows local users to overwrite arbitrary files via a symlink attack on the hugin_debug_optim_results.txt temporary file.

The remote host is affected by the vulnerability described in GLSA-200712-01 (Hugin: Insecure temporary file creation)

    Suse Linux reported that Hugin creates the     'hugin_debug_optim_results.txt' temporary file in an insecure manner.
  Impact :

    A local attacker could exploit this vulnerability with a symlink     attack, potentially overwriting an arbitrary file with the privileges     of the user running the application.
  Workaround :

    There is no known workaround at this time.

- Mon Nov 5 2007 Bruno Postle <bruno at postle.net>     0.6.1-11

    - fix for CVE-2007-5200 hugin unsafe temporary file       usage

    - bug #332401; bug #362851; bug #362861; bug #362871

    - fix Source tag

    - update license GPL -> GPLv2+

    - Mon Aug 13 2007 Bruno Postle <bruno at postle.net>       0.6.1-7

    - rebuild for boost soname change

    - add enblend dependency as enblend is now in fedora

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Mon Nov 5 2007 Bruno Postle <bruno at postle.net>     0.6.1-11

    - fix for CVE-2007-5200 hugin unsafe temporary file       usage

    - bug #332401; bug #362851; bug #362861; bug #362871

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of hugin disabled the usage of a temporary file.
(CVE-2007-5200)

ID	Name	Product	Family	Severity
29231	GLSA-200712-01 : Hugin: Insecure temporary file creation	Nessus	Gentoo Local Security Checks	low
28154	Fedora 7 : hugin-0.6.1-11.fc7 (2007-2989)	Nessus	Fedora Local Security Checks	low
27807	Fedora 8 : hugin-0.6.1-11.fc8 (2007-2807)	Nessus	Fedora Local Security Checks	low
27268	openSUSE 10 Security Update : hugin (hugin-4518)	Nessus	SuSE Local Security Checks	low

Detections

Analytics

CVE-2007-5200

medium

Tenable Plugins

low

low

low

low