CVE-2008-1687: High severity gnu m4 vulnerability
The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-1687?
CVE-2008-1687 is classified as a medium severity vulnerability due to the potential for attackers to exploit the improper quoting in file creation functions.
How do I fix CVE-2008-1687?
To fix CVE-2008-1687, upgrade to GNU m4 version 1.4.11 or later, where the issues with maketemp and mkstemp have been addressed.
What systems are affected by CVE-2008-1687?
CVE-2008-1687 affects GNU m4 versions up to 1.4.10, which may lead to improper file handling.
What can attackers achieve by exploiting CVE-2008-1687?
By exploiting CVE-2008-1687, attackers may trigger macro expansions leading to the use of incorrect filenames, which can create security risks.
Is there a workaround for CVE-2008-1687 if I cannot upgrade?
If upgrading is not possible, consider limiting access to the system or using alternative methods for file creation that do not involve the vulnerable functions.