----------------------------------------------------------------------

Want a new IT Security job?

Vacant positions at Secunia:
http://secunia.com/secunia_vacancies/

----------------------------------------------------------------------

TITLE:
Mathopd Insecure Dump File Creation Vulnerability

SECUNIA ADVISORY ID:
SA14524

VERIFY ADVISORY:
http://secunia.com/advisories/14524/

CRITICAL:
Not critical

IMPACT:
Manipulation of data

WHERE:
Local system

SOFTWARE:
Mathopd 1.x
http://secunia.com/product/2607/

DESCRIPTION:
Secunia Research has discovered a vulnerability in Mathopd, which can
be exploited by malicious, local users to corrupt the contents of
arbitrary files on a vulnerable system.

The vulnerability is caused due to the "internal_dump()" function
creating dump files insecurely when a SIGWINCH signal is caught. This
can be exploited via symlink attacks to append dump data to arbitrary
files on the system with the privileges of the user running Mathopd.

Successful exploitation requires that Mathopd is running with the
"-n" command line option, and the user running Mathopd resizes the
terminal window.

The vulnerability has been confirmed in versions 1.5p4 and 1.6b5.
Other versions may also be affected.

SOLUTION:
Update to version 1.5p5.
http://www.mathopd.org/download.html

The vulnerability has also been fixed in the 1.6b6 BETA release.

PROVIDED AND/OR DISCOVERED BY:
Carsten Eiram, Secunia Research.

ORIGINAL ADVISORY:
http://www.mail-archive.com/mathopd%40mathopd.org/msg00272.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------