Vulnerabilities > CVE-2005-3342 - Unspecified vulnerability in Norman Ramsey Noweb 2.10C/2.9A

047910
CVSS 1.2 - LOW
Attack vector
LOCAL
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
PARTIAL
Availability impact
NONE
local
high complexity
norman-ramsey
nessus

Summary

noweb 2.10c and earlier allows local users to overwrite arbitrary files via symlink attacks on temporary files in (1) lib/toascii.nw and (2) shell/roff.mm.

Vulnerable Configurations

Part Description Count
Application
Norman_Ramsey
2

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-968.NASL
    descriptionJavier Fernandez-Sanguino Pena from the Debian Security Audit project discovered that a script in noweb, a web like literate-programming tool, creates a temporary file in an insecure fashion.
    last seen2020-06-01
    modified2020-06-02
    plugin id22834
    published2006-10-14
    reporterThis script is Copyright (C) 2006-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/22834
    titleDebian DSA-968-1 : noweb - insecure temporary file
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-968. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(22834);
      script_version("1.18");
      script_cvs_date("Date: 2019/08/02 13:32:20");
    
      script_cve_id("CVE-2005-3342");
      script_xref(name:"DSA", value:"968");
    
      script_name(english:"Debian DSA-968-1 : noweb - insecure temporary file");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Javier Fernandez-Sanguino Pena from the Debian Security Audit
    project discovered that a script in noweb, a web like
    literate-programming tool, creates a temporary file in an insecure
    fashion."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.debian.org/security/2006/dsa-968"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the nowebm package.
    
    For the old stable distribution (woody) this problem has been fixed in
    version 2.9a-7.4.
    
    For the stable distribution (sarge) this problem has been fixed in
    version 2.10c-3.2."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:N/C:N/I:P/A:N");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:noweb");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:3.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:3.1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2006/02/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2006/10/14");
      script_set_attribute(attribute:"vuln_publication_date", value:"2006/02/13");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2006-2019 Tenable Network Security, Inc.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"3.0", prefix:"nowebm", reference:"2.9a-7.4")) flag++;
    if (deb_check(release:"3.1", prefix:"nowebm", reference:"2.10c-3.2")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_note(port:0, extra:deb_report_get());
      else security_note(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-254-1.NASL
    descriptionJavier Fernandez-Sanguino Pena discovered that noweb scripts created temporary files in an insecure way. This could allow a symlink attack to create or overwrite arbitrary files with the privileges of the user running noweb. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id21062
    published2006-03-13
    reporterUbuntu Security Notice (C) 2006-2019 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/21062
    titleUbuntu 4.10 / 5.04 / 5.10 : noweb vulnerability (USN-254-1)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200602-14.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200602-14 (noweb: Insecure temporary file creation) Javier Fernandez-Sanguino has discovered that the lib/toascii.nw and shell/roff.mm scripts insecurely create temporary files with predictable filenames. Impact : A local attacker could create symbolic links in the temporary file directory, pointing to a valid file somewhere on the filesystem. When an affected script is called, this would result in the file being overwritten with the rights of the user running the script. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id20980
    published2006-02-27
    reporterThis script is Copyright (C) 2006-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/20980
    titleGLSA-200602-14 : noweb: Insecure temporary file creation