Launchpad.net

CVE 2007-5839

The e_hostname function in commands.c in BitchX 1.1a allows local users to overwrite arbitrary files via a symlink attack on temporary files when using the (1) HOSTNAME or (2) IRCHOST command.

Related bugs and status

CVE-2007-5839 (Candidate) is related to these bugs:

Bug #162295: CVE-2007-5839: Insecure temporary file creation

		In	Importance	Status
162295	CVE-2007-5839: Insecure temporary file creation	ircii-pana (Ubuntu)	Medium	Invalid
162295	CVE-2007-5839: Insecure temporary file creation	ircii-pana (Debian)	Unknown	Fix Released
162295	CVE-2007-5839: Insecure temporary file creation	ircii-pana (Ubuntu Dapper)	Medium	Won't Fix
162295	CVE-2007-5839: Insecure temporary file creation	ircii-pana (Ubuntu Edgy)	Medium	Won't Fix
162295	CVE-2007-5839: Insecure temporary file creation	ircii-pana (Ubuntu Feisty)	Medium	Won't Fix
162295	CVE-2007-5839: Insecure temporary file creation	ircii-pana (Ubuntu Hardy)	Medium	Invalid
162295	CVE-2007-5839: Insecure temporary file creation	ircii-pana (Ubuntu Gutsy)	Medium	Won't Fix

See the

CVE page on Mitre.org for more details.

References

CONFIRM: http://bugs.debian.org...
BID: 26326
SECUNIA: 27463
GENTOO: GLSA-200807-12
SECUNIA: 31180
OSVDB: 42061
SECUNIA: 34870
VUPEN: ADV-2007-3714
SLACKWARE: SSA:2009-116-02
XF: bitchx-ehostname-symli...