GNU CFEngine Insecure Temporary File Creation Vulnerability

GNU CFEngine Insecure Temporary File Creation Vulnerability

Solution:
Debian has released advisory DSA 835-1 and fixes to address this issue. Please see the referenced advisory for additional information.

Debian has released advisory DSA 836-1 and fixes to address this issue for cfengine2. Please see the referenced advisory for additional information.

Ubuntu has released advisory USN-198-1 to address this issue. Please see the referenced advisory for more information.

Mandriva Linux has released security advisory MDKSA-2005:184 addressing this issue. Please see the referenced advisory for further information.

SUSE Linux has released security summary report SUSE-SR:2005:023 addressing this and other issues. Please see the referenced advisory for further information.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com <mailto:vuldb@securityfocus.com>.

GNU Cfengine 1.6.3

Debian cfengine-doc_1.6.3-9woody1_all.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/c/cfengine/cfengine-doc_1 .6.3-9woody1_all.deb

Debian cfengine-doc_1.6.5-1sarge1_all.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine-doc_1 .6.5-1sarge1_all.deb

Debian cfengine_1.6.3-9woody1_alpha.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3 -9woody1_alpha.deb

Debian cfengine_1.6.3-9woody1_arm.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3 -9woody1_arm.deb

Debian cfengine_1.6.3-9woody1_hppa.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3 -9woody1_hppa.deb

Debian cfengine_1.6.3-9woody1_i386.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3 -9woody1_i386.deb

Debian cfengine_1.6.3-9woody1_ia64.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3 -9woody1_ia64.deb

Debian cfengine_1.6.3-9woody1_m68k.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3 -9woody1_m68k.deb

Debian cfengine_1.6.3-9woody1_mips.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3 -9woody1_mips.deb

Debian cfengine_1.6.3-9woody1_mipsel.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3 -9woody1_mipsel.deb

Debian cfengine_1.6.3-9woody1_powerpc.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3 -9woody1_powerpc.deb

Debian cfengine_1.6.3-9woody1_s390.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3 -9woody1_s390.deb

Debian cfengine_1.6.3-9woody1_sparc.deb
Debian GNU/Linux 3.0 alias woody
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3 -9woody1_sparc.deb

Debian cfengine_1.6.5-1sarge1_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5 -1sarge1_amd64.deb

Debian cfengine_1.6.5-1sarge1_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5 -1sarge1_arm.deb

Debian cfengine_1.6.5-1sarge1_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5 -1sarge1_hppa.deb

Debian cfengine_1.6.5-1sarge1_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5 -1sarge1_i386.deb

Debian cfengine_1.6.5-1sarge1_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5 -1sarge1_ia64.deb

Debian cfengine_1.6.5-1sarge1_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5 -1sarge1_m68k.deb

Debian cfengine_1.6.5-1sarge1_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5 -1sarge1_mips.deb

Debian cfengine_1.6.5-1sarge1_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5 -1sarge1_mipsel.deb

Debian cfengine_1.6.5-1sarge1_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5 -1sarge1_powerpc.deb

Debian cfengine_1.6.5-1sarge1_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5 -1sarge1_s390.deb

Debian cfengine_1.6.5-1sarge1_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5 -1sarge1_sparc.deb

Mandriva cfengine-1.6.3-8.3.C21mdk.i586.rpm
Corporate Server 2.1:
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cfengine-1.6.3-8.3.C21mdk.x86_64.rpm
Corporate Server 2.1/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3

GNU Cfengine 1.6.5

Debian cfengine_1.6.5-1sarge1_alpha.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5 -1sarge1_alpha.deb

Debian cfengine_1.6.5-1sarge1_amd64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5 -1sarge1_amd64.deb

Debian cfengine_1.6.5-1sarge1_arm.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5 -1sarge1_arm.deb

Debian cfengine_1.6.5-1sarge1_hppa.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5 -1sarge1_hppa.deb

Debian cfengine_1.6.5-1sarge1_i386.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5 -1sarge1_i386.deb

Debian cfengine_1.6.5-1sarge1_ia64.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5 -1sarge1_ia64.deb

Debian cfengine_1.6.5-1sarge1_m68k.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5 -1sarge1_m68k.deb

Debian cfengine_1.6.5-1sarge1_mips.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5 -1sarge1_mips.deb

Debian cfengine_1.6.5-1sarge1_mipsel.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5 -1sarge1_mipsel.deb

Debian cfengine_1.6.5-1sarge1_powerpc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5 -1sarge1_powerpc.deb

Debian cfengine_1.6.5-1sarge1_s390.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5 -1sarge1_s390.deb

Debian cfengine_1.6.5-1sarge1_sparc.deb
Debian GNU/Linux 3.1 alias sarge
http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5 -1sarge1_sparc.deb

Mandriva cfengine-1.6.5-3.3.C30mdk.i586.rpm
Corporate 3.0:
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cfengine-1.6.5-4.3.101mdk.i586.rpm
Mandrivalinux 10.1:
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cfengine-1.6.5-4.3.101mdk.x86_64.rpm
Mandrivalinux 10.1/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3

GNU Cfengine 2.1.12

Mandriva cfengine-2.1.12-7.2.102mdk.i586.rpm
Mandrivalinux 10.2:
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cfengine-2.1.12-7.2.102mdk.x86_64.rpm
Mandrivalinux 10.2/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cfengine-cfservd-2.1.12-7.2.102mdk.i586.rpm
Mandrivalinux 10.2:
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cfengine-cfservd-2.1.12-7.2.102mdk.x86_64.rpm
Mandrivalinux 10.2/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3

GNU Cfengine 2.1.15

Mandriva cfengine-base-2.1.15-2.2.20060mdk.i586.rpm
Mandrivalinux 2006.0:
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cfengine-base-2.1.15-2.2.20060mdk.x86_64.rpm
Mandrivalinux 2006.0/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cfengine-cfagent-2.1.15-2.2.20060mdk.i586.rpm
Mandrivalinux 2006.0:
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cfengine-cfagent-2.1.15-2.2.20060mdk.x86_64.rpm
Mandrivalinux 2006.0/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cfengine-cfenvd-2.1.15-2.2.20060mdk.i586.rpm
Mandrivalinux 2006.0:
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cfengine-cfenvd-2.1.15-2.2.20060mdk.x86_64.rpm
Mandrivalinux 2006.0/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cfengine-cfexecd-2.1.15-2.2.20060mdk.i586.rpm
Mandrivalinux 2006.0:
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cfengine-cfexecd-2.1.15-2.2.20060mdk.x86_64.rpm
Mandrivalinux 2006.0/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cfengine-cfservd-2.1.15-2.2.20060mdk.i586.rpm
Mandrivalinux 2006.0:
http://www1.mandrivalinux.com/en/ftp.php3

Mandriva cfengine-cfservd-2.1.15-2.2.20060mdk.x86_64.rpm
Mandrivalinux 2006.0/X86_64:
http://www1.mandrivalinux.com/en/ftp.php3