Test ID:	1.3.6.1.4.1.25623.1.0.53448
Category:	Debian Local Security Checks
Title:	Debian Security Advisory DSA 202-2 (im)
Summary:	The remote host is missing an update to im;announced via advisory DSA 202-2.
Description:	Summary: The remote host is missing an update to im announced via advisory DSA 202-2. Vulnerability Insight: Despite popular belief, the IM packages are not architecture independent, since the number of the fsync syscal is detected on build time and this number differs on Linux architectures and other operating systems. As a result of this the optional feature ``NoSync=no'' does only work on the architecture the package was built on. As usual, we are including the text of the original advisory DSA 202-1: Tatsuya Kinoshita discovered that IM, which contains interface commands and Perl libraries for E-mail and NetNews, creates temporary files insecurely. 1. The impwagent program creates a temporary directory in an insecure manner in /tmp using predictable directory names without checking the return code of mkdir, so it's possible to seize a permission of the temporary directory by local access as another user. 2. The immknmz program creates a temporary file in an insecure manner in /tmp using a predictable filename, so an attacker with local access can easily create and overwrite files as another user. This problem has been fixed in version 141-18.2 for the current stable distribution (woody), in version 133-2.3 of the old stable distribution (potato). A correection is expected for the unstable distribution (sid) soon. Solution: We recommend that you upgrade your IM package. CVSS Score: 2.1 CVSS Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2002-1395 BugTraq ID: 6307 http://www.securityfocus.com/bid/6307 Debian Security Information: DSA-202 (Google Search) http://www.debian.org/security/2002/dsa-202 http://www.redhat.com/support/errata/RHSA-2003-039.html http://secunia.com/advisories/8166 http://secunia.com/advisories/8242 http://www.iss.net/security_center/static/10767.php http://www.iss.net/security_center/static/10766.php
Copyright	Copyright (C) 2008 E-Soft Inc.

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.