CVE-2014-1640: Low severity Debian Axiom vulnerability
axiom-test.sh in axiom 20100701-1.1 uses tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1640?
CVE-2014-1640 is classified as a high severity vulnerability due to its potential for arbitrary file overwriting via a symlink attack.
How do I fix CVE-2014-1640?
To fix CVE-2014-1640, update the Axiom package to a version that does not use temporary file creation through symlinks.
Who is affected by CVE-2014-1640?
CVE-2014-1640 affects users of the Axiom software version 20100701-1.1 on Debian systems.
What does CVE-2014-1640 allow attackers to do?
CVE-2014-1640 allows local users to overwrite arbitrary files on the system through a symlink attack.
Is there a patch available for CVE-2014-1640?
Yes, a patch for CVE-2014-1640 can be obtained by updating to a fixed version of the Axiom software.