Debian Security Advisory

DSA-172-1 tkmail -- insecure temporary files

Date Reported:

08 Oct 2002

Affected Packages:

tkmail

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2002-1193.

More information:

It has been discovered that tkmail creates temporary files insecurely. Exploiting this an attacker with local access can easily create and overwrite files as another user.

This problem has been fixed in version 4.0beta9-8.1 for the current stable distribution (woody), in version 4.0beta9-4.1 for the old stable distribution (potato) and in version 4.0beta9-9 for the unstable distribution (sid).

We recommend that you upgrade your tkmail packages.

Fixed in:

Debian GNU/Linux 2.2 (potato)

Source:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-4.1.dsc; http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-4.1.diff.gz; http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9.orig.tar.gz
Alpha:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-4.1_alpha.deb
ARM:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-4.1_arm.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-4.1_i386.deb
Motorola 680x0:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-4.1_m68k.deb
PowerPC:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-4.1_powerpc.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-4.1_sparc.deb

Debian GNU/Linux 3.0 (woody)

Source:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1.dsc; http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1.diff.gz; http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9.orig.tar.gz
Alpha:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1_alpha.deb
ARM:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1_arm.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1_i386.deb
Intel IA-64:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1_ia64.deb
HP Precision:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1_hppa.deb
Motorola 680x0:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1_m68k.deb
Big endian MIPS:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1_mips.deb
Little endian MIPS:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1_mipsel.deb
PowerPC:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1_powerpc.deb
IBM S/390:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1_s390.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1_sparc.deb

MD5 checksums of the listed files are available in the original advisory.