The MagnatuneBrowser::listDownloadComplete function in magnatunebrowser/magnatunebrowser.cpp in Amarok before 1.4.10 allows local users to overwrite arbitrary files via a symlink attack on the album_info.xml temporary file.

Dwayne Litzenberger discovered that Amarok created temporary files in an insecure way. Local users could exploit a race condition to create or overwrite files with the privileges of the user invoking the program. (CVE-2008-3699).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw in Amarok prior to 1.4.10 would allow local users to overwrite arbitrary files via a symlink attack on a temporary file that Amarok created with a predictable name (CVE-2008-3699).

The updated packages have been patched to correct this issue.

Amarok 1.4.10 has been released to fix a security problem. For more information please see http://amarok.kde.org/en/node/535/ Please update.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200809-08 (Amarok: Insecure temporary file creation)

    Dwayne Litzenberger reported that the     MagnatuneBrowser::listDownloadComplete() function in     magnatunebrowser/magnatunebrowser.cpp uses the album_info.xml temporary     file in an insecure manner.
  Impact :

    A local attacker could perform a symlink attack to overwrite arbitrary     files on the system with the privileges of the user running the     application.
  Workaround :

    There is no known workaround at this time.

New Amarok packages are available for Slackware 11.0, 12.0, 12.1, and
-current to fix security issues. In addition, new supporting libgpod packages are available for Slackware 11.0 and 12.0, since a newer version of libgpod than shipped with these releases is required to run Amarok version 1.4.10. The Magnatune music library plugin made insecure use of the /tmp directory, allowing malicious local users to overwrite files owned by the user running Amarok through symlink attacks.

ID	Name	Product	Family	Severity
37944	Ubuntu 7.10 / 8.04 LTS : amarok vulnerability (USN-657-1)	Nessus	Ubuntu Local Security Checks	low
36594	Mandriva Linux Security Advisory : amarok (MDVSA-2008:172)	Nessus	Mandriva Local Security Checks	low
34148	Fedora 9 : amarok-1.4.10-1.fc9 (2008-7739)	Nessus	Fedora Local Security Checks	low
34146	Fedora 8 : amarok-1.4.10-1.fc8 (2008-7719)	Nessus	Fedora Local Security Checks	low
34115	GLSA-200809-08 : Amarok: Insecure temporary file creation	Nessus	Gentoo Local Security Checks	low
34061	Slackware 11.0 / 12.0 / 12.1 / current : amarok (SSA:2008-241-01)	Nessus	Slackware Local Security Checks	low

Detections

Analytics

CVE-2008-3699

medium

Tenable Plugins

low

low

low

low

low

low