CVE-2013-0350 in Pkstat
Summary
by MITRE
tmp_smtp.c in pktstat 1.8.5 allows local users to overwrite arbitrary files via a symlink attack on /tmp/smtp.log.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/12/2026
The vulnerability described in CVE-2013-0350 represents a classic symlink attack scenario that exploits improper temporary file handling within the pktstat network monitoring tool version 1.8.5. This issue resides in the tmp_smtp.c component which manages SMTP logging functionality, creating a path traversal and file overwrite condition that can be exploited by local users with minimal privileges. The vulnerability stems from the application's failure to properly validate or secure temporary file creation processes, specifically when handling the /tmp/smtp.log file path.
The technical flaw manifests when pktstat creates or accesses the /tmp/smtp.log file without implementing proper security measures to prevent symbolic link manipulation. Attackers can create malicious symbolic links in the /tmp directory that point to sensitive system files, allowing them to overwrite critical files with arbitrary content. This type of vulnerability falls under the CWE-377 weakness category, specifically CWE-377: Insecure Temporary File, which is characterized by the creation of temporary files with insecure permissions or predictable names that can be manipulated by unauthorized users. The attack vector relies on the predictable nature of temporary file paths and the lack of atomic file creation mechanisms that would prevent symlink attacks.
From an operational impact perspective, this vulnerability enables local users to potentially escalate their privileges or cause denial of service conditions within the system where pktstat is deployed. The ability to overwrite arbitrary files creates opportunities for persistent backdoor installation, configuration file corruption, or critical system file modification that could lead to system compromise. The attack requires only local access and knowledge of the application's temporary file handling behavior, making it particularly dangerous in multi-user environments where privilege separation is not properly enforced. This vulnerability also aligns with ATT&CK technique T1059.007 for Command and Scripting Interpreter: PowerShell, as attackers may leverage the file overwrite capability to establish persistent access through modified system files.
Mitigation strategies for CVE-2013-0350 should focus on implementing proper temporary file handling practices that prevent symbolic link manipulation attacks. The most effective approach involves using secure temporary file creation methods that utilize atomic operations with proper file permissions, such as creating files with restricted permissions and using unique, unpredictable names. System administrators should ensure that pktstat is updated to a version that addresses this vulnerability, as the original 1.8.5 release contains no built-in protections against this class of attack. Additionally, implementing proper file system permissions and monitoring for unauthorized symbolic link creation in temporary directories can help detect and prevent exploitation attempts. The remediation should also include reviewing other applications for similar temporary file handling issues and implementing comprehensive security controls that align with security standards such as those outlined in the OWASP Secure Coding Practices, which specifically recommend avoiding predictable temporary file names and implementing proper file creation atomicity to prevent symlink attacks.