isearch Package up to 1.47 /tmp tempnam cleanup

Summaryinfo

A vulnerability classified as critical has been found in isearch Package up to 1.47. This affects the function tempnam of the file /tmp. The manipulation leads to cleanup. This vulnerability is documented as CVE-2012-5663. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in isearch Package up to 1.47. This issue affects the function tempnam of the file /tmp. The manipulation with an unknown input leads to a cleanup vulnerability. Using CWE to declare the problem leads to CWE-459. The product does not properly "clean up" and remove temporary or supporting resources after they have been used. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The isearch package (textproc/isearch) before 1.47.01nb1 uses the tempnam() function to create insecure temporary files into a publicly-writable area (/tmp).

The weakness was released 12/30/2019. The identification of this vulnerability is CVE-2012-5663 since 10/24/2012. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

Upgrading to version 1.47.01nb1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at OSVDB (88660†). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• isearch Package

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37
• 1.38
• 1.39
• 1.40
• 1.41
• 1.42
• 1.43
• 1.44
• 1.45
• 1.46
• 1.47

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion