Description of problem:

A security flaw was discovered in the Python generic FAQ wizard moving tool (move-faqwiz.sh).

Relevant part of the code:

28 cutnpad $1 2 suffix1 29 cutnpad $2 1 prefix2 30 cutnpad $2 2 suffix2 31 tmpfile=tmp$RANDOM.tmp 32 file1=faq$prefix1.$suffix1.htp 33 file2=faq$prefix2.$suffix2.htp

Description:

An attacker could in advance create a symbolic link pointing to tmpXXXXX.tmp (the output produced by $RANDOM is only 5 digits long), then run the Python generic FAQ wizard moving tool which would allow him to erase / truncate the target of the symbolic link to zero size.

References:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=498899