• info
• discussion
• exploit
• solution
• references

Noweb Insecure Temporary File Creation Vulnerability

Solution:
Please see the referenced vendor advisories for details on obtaining and applying fixes.


Norman Ramsey Noweb 2.10 c

• Debian nowebm_2.10c-3.2_alpha.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/n/noweb/nowebm_2.10c-3.2_ alpha.deb


• Debian nowebm_2.10c-3.2_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/n/noweb/nowebm_2.10c-3.2_ amd64.deb


• Debian nowebm_2.10c-3.2_arm.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/n/noweb/nowebm_2.10c-3.2_ arm.deb


• Debian nowebm_2.10c-3.2_hppa.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/n/noweb/nowebm_2.10c-3.2_ hppa.deb


• Debian nowebm_2.10c-3.2_i386.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/n/noweb/nowebm_2.10c-3.2_ i386.deb


• Debian nowebm_2.10c-3.2_ia64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/n/noweb/nowebm_2.10c-3.2_ ia64.deb


• Debian nowebm_2.10c-3.2_m68k.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/n/noweb/nowebm_2.10c-3.2_ m68k.deb


• Debian nowebm_2.10c-3.2_mips.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/n/noweb/nowebm_2.10c-3.2_ mips.deb


• Debian nowebm_2.10c-3.2_mipsel.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/n/noweb/nowebm_2.10c-3.2_ mipsel.deb


• Debian nowebm_2.10c-3.2_powerpc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/n/noweb/nowebm_2.10c-3.2_ powerpc.deb


• Debian nowebm_2.10c-3.2_s390.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/n/noweb/nowebm_2.10c-3.2_ s390.deb


• Debian nowebm_2.10c-3.2_sparc.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/n/noweb/nowebm_2.10c-3.2_ sparc.deb


• Ubuntu nowebm_2.10c-3.1ubuntu5.04.1_amd64.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/n/noweb/nowebm_2.10c-3.1ub untu5.04.1_amd64.deb


• Ubuntu nowebm_2.10c-3.1ubuntu5.04.1_i386.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/n/noweb/nowebm_2.10c-3.1ub untu5.04.1_i386.deb


• Ubuntu nowebm_2.10c-3.1ubuntu5.04.1_powerpc.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/n/noweb/nowebm_2.10c-3.1ub untu5.04.1_powerpc.deb


• Ubuntu nowebm_2.10c-3.1ubuntu5.10.1_amd64.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/n/noweb/nowebm_2.10c-3.1ub untu5.10.1_amd64.deb


• Ubuntu nowebm_2.10c-3.1ubuntu5.10.1_amd64.deb
  Ubuntu 5.10 (Breezy Badger)
  http://security.ubuntu.com/ubuntu/pool/main/n/noweb/nowebm_2.10c-3.1ub untu5.10.1_amd64.deb


• Ubuntu nowebm_2.10c-3.1ubuntu5.10.1_i386.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/n/noweb/nowebm_2.10c-3.1ub untu5.10.1_i386.deb


• Ubuntu nowebm_2.10c-3.1ubuntu5.10.1_i386.deb
  Ubuntu 5.10 (Breezy Badger)
  http://security.ubuntu.com/ubuntu/pool/main/n/noweb/nowebm_2.10c-3.1ub untu5.10.1_i386.deb


• Ubuntu nowebm_2.10c-3.1ubuntu5.10.1_powerpc.deb
  Ubuntu 5.04 (Hoary Hedgehog)
  http://security.ubuntu.com/ubuntu/pool/main/n/noweb/nowebm_2.10c-3.1ub untu5.10.1_powerpc.deb


• Ubuntu nowebm_2.10c-3.1ubuntu5.10.1_powerpc.deb
  Ubuntu 5.10 (Breezy Badger)
  http://security.ubuntu.com/ubuntu/pool/main/n/noweb/nowebm_2.10c-3.1ub untu5.10.1_powerpc.deb


• Ubuntu nowebm_2.10c-3ubuntu1.1_amd64.deb
  Ubuntu 4.10 (Warty Warthog)
  http://security.ubuntu.com/ubuntu/pool/main/n/noweb/nowebm_2.10c-3ubun tu1.1_amd64.deb


• Ubuntu nowebm_2.10c-3ubuntu1.1_i386.deb
  Ubuntu 4.10 (Warty Warthog)
  http://security.ubuntu.com/ubuntu/pool/main/n/noweb/nowebm_2.10c-3ubun tu1.1_i386.deb


• Ubuntu nowebm_2.10c-3ubuntu1.1_powerpc.deb
  Ubuntu 4.10 (Warty Warthog)
  http://security.ubuntu.com/ubuntu/pool/main/n/noweb/nowebm_2.10c-3ubun tu1.1_powerpc.deb

Norman Ramsey Noweb 2.9 a

• Debian noweb_2.9a-7.4.diff.gz
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/n/noweb/noweb_2.9a-7.4.di ff.gz


• Debian nowebm_2.9a-7.4_alpha.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/n/noweb/nowebm_2.9a-7.4_a lpha.deb


• Debian nowebm_2.9a-7.4_hppa.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/n/noweb/nowebm_2.9a-7.4_h ppa.deb


• Debian nowebm_2.9a-7.4_i386.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/n/noweb/nowebm_2.9a-7.4_i 386.deb


• Debian nowebm_2.9a-7.4_m68k.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/n/noweb/nowebm_2.9a-7.4_m 68k.deb


• Debian nowebm_2.9a-7.4_mips.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/n/noweb/nowebm_2.9a-7.4_m ips.deb


• Debian nowebm_2.9a-7.4_mipsel.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/n/noweb/nowebm_2.9a-7.4_m ipsel.deb


• Debian nowebm_2.9a-7.4_powerpc.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/n/noweb/nowebm_2.9a-7.4_p owerpc.deb


• Debian nowebm_2.9a-7.4_s390.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/n/noweb/nowebm_2.9a-7.4_s 390.deb


• Debian nowebm_2.9a-7.4_sparc.deb
  Debian GNU/Linux 3.0 alias woody
  http://security.debian.org/pool/updates/main/n/noweb/nowebm_2.9a-7.4_s parc.deb