CVE-2014-1638: Low severity Debian localepurge vulnerability
(1) debian/postrm and (2) debian/localepurge.config in localepurge before 0.7.3.2 use tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
localepurgeto a version that resolves this vulnerability.Fixed in 0.7.3.2 - Operational
Update localepurge’s scripts so that in debian/postrm and debian/localepurge.config (before 0.7.3.2) tempfile is not used in a way that appends a suffix to the original filename and writes to that new filename; ensure the temporary file handling uses tempfile safely to prevent the symlink overwrite condition.
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1638?
CVE-2014-1638 is classified as a medium severity vulnerability due to the potential for local users to exploit it.
How do I fix CVE-2014-1638?
To fix CVE-2014-1638, upgrade to localepurge version 0.7.3.2 or later, which addresses the symlink vulnerability.
What software is affected by CVE-2014-1638?
CVE-2014-1638 affects localepurge versions prior to 0.7.3.2 on Debian systems.
What type of attack does CVE-2014-1638 allow?
CVE-2014-1638 allows local users to perform a symlink attack to overwrite arbitrary files.
Is CVE-2014-1638 a remote vulnerability?
No, CVE-2014-1638 is not a remote vulnerability; it requires local access to exploit.