CVE-2001-1593: Low severity GNU a2ps vulnerability
Jakub Wilk found that a2ps, a tool to convert text and other types of files to PostScript, insecurely used a temporary file in spyuser(). A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running a2ps.
The original report in the Debian bug tracking system (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737385) notes the issue is in src/main.c:
559 tempnameensure (job->tmpfilenames[0]); 560 spyname = job->tmpfilenames[0]; 561 spy = fopen (spyname, "w");
And also notes there are other calls to tempnameensure().
Other sources
The tempnameensure function in lib/routines.h in a2ps 4.14 and earlier, as used by the spyuser function and possibly other functions, allows local users to modify arbitrary files via a symlink attack on a temporary file.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2001-1593?
CVE-2001-1593 is considered a medium severity vulnerability due to the potential for local attackers to exploit it.
How do I fix CVE-2001-1593?
To fix CVE-2001-1593, upgrade a2ps to version 4.14 or later.
Who is affected by CVE-2001-1593?
CVE-2001-1593 affects users of GNU a2ps versions 4.10.3, 4.10.4, 4.13, 4.13b, and 4.12.
What type of attack does CVE-2001-1593 enable?
CVE-2001-1593 enables local attackers to perform symbolic link attacks.
Is CVE-2001-1593 a remote vulnerability?
No, CVE-2001-1593 is not a remote vulnerability; it requires local access to exploit.