CVE-2003-0887: Low severity Angus Mackay Ez-ipupdate vulnerability
ez-ipupdate 3.0.11b7 and earlier creates insecure temporary cache files, which allows local users to conduct unauthorized operations via a symlink attack on the ez-ipupdate.cache file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict filesystem write access to the directory that contains ez-ipupdate.cache so that only the account running ez-ipupdate can create or modify files there. Remove write permission for group and others on that directory and on the ez-ipupdate.cache file to prevent local unprivileged users from creating symlink attacks.
- Operational
Inspect the path(s) where ez-ipupdate creates ez-ipupdate.cache for any symlinks (an existing symlink indicates exploitation). Remove any symlink replacing ez-ipupdate.cache, recreate ez-ipupdate.cache as a regular file owned by the ez-ipupdate process account, and verify file ownership and permissions prevent non-owner writes.
Event History
Frequently Asked Questions
What is the severity of CVE-2003-0887?
CVE-2003-0887 has a medium severity rating due to its potential for local users to conduct unauthorized operations.
How do I fix CVE-2003-0887?
Fix CVE-2003-0887 by updating to a version of ez-ipupdate that is 3.0.11b8 or later which addresses the symlink vulnerability.
What causes the vulnerability in CVE-2003-0887?
The vulnerability in CVE-2003-0887 is caused by ez-ipupdate creating insecure temporary cache files that are susceptible to symlink attacks.
Who is affected by CVE-2003-0887?
CVE-2003-0887 affects users of ez-ipupdate version 3.0.11b7 and earlier on systems where local users have access.
What are symlink attacks related to CVE-2003-0887?
Symlink attacks in the context of CVE-2003-0887 involve malicious local users creating symbolic links to exploit vulnerabilities in the handling of temporary files.