• info
• discussion
• exploit
• solution
• references

Smb4k Insecure Temporary File Creation Vulnerability

Solution:
Mandriva has released advisory MDKSA-2005:157 and fixes to address this issue. Please see the referenced advisory for links to fixed packages.

The vendor has addressed this issue in Smb4k 0.6.3. Patches are also available for previous versions:

Gentoo has released advisory GLSA 200511-15 and fixes to address this issue. Please see the referenced advisory for links to fixed packages.


Smb4k Smb4k 0.4

• Mandriva smb4k-0.4.0-3.1.101mdk.i586.rpm
  Mandrakelinux 10.1
  http://www1.mandrivalinux.com/en/ftp.php3


• Mandriva smb4k-0.5.1-1.1.102mdk.i586.rpm
  Mandrakelinux 10.1
  http://www1.mandrivalinux.com/en/ftp.php3


• Smb4k 001_security_fix_smb4k_0.4.1a.diff.gz
  http://download.berlios.de/smb4k/001_security_fix_smb4k_0.4.1a.diff.gz

Smb4k Smb4k 0.5.1

• Mandriva smb4k-0.5.1-1.1.102mdk.i586.rpm
  Mandrakelinux 10.1
  http://www1.mandrivalinux.com/en/ftp.php3

Smb4k Smb4k 0.6

• Smb4k smb4k-0.6.3.tar.gz
  http://download.berlios.de/smb4k/smb4k-0.6.3.tar.gz