Test ID:	1.3.6.1.4.1.25623.1.0.53445
Category:	Debian Local Security Checks
Title:	Debian Security Advisory DSA 202-1 (im)
Summary:	The remote host is missing an update to im announced via advisory DSA 202-1.;; This VT has been deprecated and merged into the VT 'Debian: Security Advisory (DSA-202)' (OID: 1.3.6.1.4.1.25623.1.0.53448).
Description:	Summary: The remote host is missing an update to im announced via advisory DSA 202-1. This VT has been deprecated and merged into the VT 'Debian: Security Advisory (DSA-202)' (OID: 1.3.6.1.4.1.25623.1.0.53448). Vulnerability Insight: Tatsuya Kinoshita discovered that IM, which contains interface commands and Perl libraries for E-mail and NetNews, creates temporary files insecurely. 1. The impwagent program creates a temporary directory in an insecure manner in /tmp using predictable directory names without checking the return code of mkdir, so it's possible to seize a permission of the temporary directory by local access as another user. 2. The immknmz program creates a temporary file in an insecure manner in /tmp using a predictable filename, so an attacker with local access can easily create and overwrite files as another user. These problems have been fixed in version 141-18.1 for the current stable distribution (woody), in version 133-2.2 of the old stable distribution (potato) and in version 141-20 for the unstable distribution (sid). Solution: We recommend that you upgrade your IM package. CVSS Score: 2.1 CVSS Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2002-1395 BugTraq ID: 6307 http://www.securityfocus.com/bid/6307 Debian Security Information: DSA-202 (Google Search) http://www.debian.org/security/2002/dsa-202 http://www.redhat.com/support/errata/RHSA-2003-039.html http://secunia.com/advisories/8166 http://secunia.com/advisories/8242 http://www.iss.net/security_center/static/10767.php http://www.iss.net/security_center/static/10766.php
Copyright	Copyright (C) 2008 E-Soft Inc.

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.