Re: CVE-request: pithos symlink vulnerability CWE-61

[Josh Bressers <bressers () redhat com>]

----- Original Message -----
> Can I get 2010 CVE-ID for Pithos symlink attack vulnerability:
> https://bugs.launchpad.net/pithos/+bug/667896
>
> Software web-page: https://launchpad.net/pithos
> Found by: lfaraone <https://launchpad.net/~lfaraone>
> Found at: 2010-10-30 (fix released same day)
> "Predictable file- or directory-names in /tmp/-directory can lead to
> symlink attack."
>
> Fixed in Debian:
>
> http://packages.debian.org/changelogs/pool/main/p/pithos/current/changelog
> says:
> pithos (0.3.5-1) unstable; urgency=high
>
> * New upstream version.
> - SECURITY UPDATE: fixes overwriting of arbitrary file via symlinks
> (LP: #667896)
> Can be still found from DST:
> http://security-tracker.debian.org/tracker/TEMP-0000000-14D1F9
>
> And in Ubuntu:
> http://changelogs.ubuntu.com/changelogs/pool/universe/p/pithos/pithos_0.3.8-1/changelog

Please use CVE-2010-4817.

Thanks.

-- 
    JB