po4a: Insecure temporary file creation

1. Gentoo Linux Security Advisory

Package	Vulnerable versions	Unaffected versions	Architecture(s)
app-text/po4a	< 0.32-r1	>= 0.32-r1	All supported architectures

Related bugreports: #189440

A vulnerability has been discovered in po4a, allowing for a symlink attack.

2. Impact Information

po4a is a set of tools for helping with the translation of documentation.

The po4a development team reported a race condition in the gettextize() function when creating the file "/tmp/gettextization.failed.po".

A local attacker could perform a symlink attack, possibly overwriting files with the permissions of the user running po4a.

3. Resolution Information

There is no known workaround at this time.

All po4a users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/po4a-0.32-r1"

4. References

Updated September 13, 2007

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.