Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 385303 (CVE-2011-3351) - net-analyzer/openvas: Insecure temp file usage (CVE-2011-3351)
Summary: net-analyzer/openvas: Insecure temp file usage (CVE-2011-3351)
Alias: CVE-2011-3351
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
Whiteboard: ~3 [noglsa]
Depends on: 402379
  Show dependency tree
Reported: 2011-10-02 03:37 UTC by Tim Sammut (RETIRED)
Modified: 2013-11-10 18:59 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Tim Sammut (RETIRED) gentoo-dev 2011-10-02 03:37:25 UTC
From the Secunia advisory at URL:

A security issue has been reported in OpenVAS Scanner, which can be exploited by malicious, local users to perform certain actions with escalated privileges.

The security issue is caused due to the application passing a predictable temporary filename to the "-r" parameter of the ovaldi application, which can be exploited to overwrite arbitrary files via symlink attacks.

The security issue is reported in version 3.2.4. Other versions may also be affected.
Comment 1 Hanno Böck gentoo-dev 2013-07-01 10:37:26 UTC
Should be fixed with updated openvas-versions now in tree.

According to this this has almost no severity:

So going ahead with no GLSA?
Comment 2 Hanno Böck gentoo-dev 2013-11-10 18:42:17 UTC
security, can we close this one? openvas is ~-only, so no glsa needed anyway.
Comment 3 Chris Reffett (RETIRED) gentoo-dev Security 2013-11-10 18:59:01 UTC
If all affected versions are gone, then yes, noglsa.