#########################################################

centericq insecure temporary file creation

Vendor: http://thekonst.net/en/centericq
Advisory: http://www.zataz.net/adviso/centericq-06152005.txt
Vendor informed: yes
Exploit available: yes
Impact : low
Exploitation : low

#########################################################

The vulnerability is caused due to temporary file being created insecurely.
This can be exploited via symlink attacks in combination  to create and overwrite arbitrary files with the privileges of the user running the affected script.

##########
Versions:
##########

centericq <= 4.20.0 

##########
Solution:
##########

To prevent symlink attack use kernel patch such as grsecurity

#########
Timeline:
#########

Discovered : 2005-05-30
Vendor notified : 2005-06-15
Vendor response : no reponse 
Vendor fix : no patch
Vendor Sec report (vendor-sec@lst.de) : 2005-06-27
Disclosure :  2005-07-04

#####################
Technical details :
#####################

Vulnerable code :
-----------------

src/hooks/gaduhook.cc

909     fname = (getenv("TMPDIR") ? getenv("TMPDIR") : "/tmp");
910     fname += "/gg.token." + i2str(getpid());

912     ofstream bf(fname.c_str());
913 
914     if(bf.is_open()) {
915         bf.write(h->body, h->body_size);
916         bf.close();
917     } else {
918         return "";
919     }

#########
Related :
#########

Bug report : http://bugs.gentoo.org/show_bug.cgi?id=94471 
CVE : CAN-2005-1914

#####################
Credits :
#####################

Eric Romang (eromang@zataz.net - ZATAZ Audit)
Thxs to Gentoo Security Team. (Taviso, jaervosz, solar, etc.)