#########################################################

sms insecure temporary files creation

Vendor: http://ceti.pl/~miki/komputery/sms.html
Advisory: http://www.zataz.net/adviso/sms-06272005.txt
Vendor informed: yes
Exploit available: yes
Impact : low
Exploitation : low

#########################################################

The vulnerability is caused due to temporary file being created insecurely.
This can be exploited via symlink attacks in combination  to create and overwrite arbitrary
files with the privileges of the user running the affected script.

##########
Versions:
##########

sms <= 1.9.2m 

##########
Solution:
##########

To prevent symlink attack use kernel patch such as grsecurity

#########
Timeline:
#########

Discovered : 2005-06-27
Vendor notified : 2005-07-12
Vendor response : 
Vendor fix : 
Vendor Sec report (vendor-sec@lst.de) : 
Disclosure :  

#####################
Technical details :
#####################

Vulnerable code :

-----------------
contrib/miastoplusa/mpl.sh

9 cat >/tmp/request1 << __ENDME__
27 cat >/tmp/request2 <<__ENDME2__
48 nc www.miastoplusa.pl 80 < /tmp/request1
54 nc www.miastoplusa.pl 80 < /tmp/request2

#########
Related :
#########

Bug report : http://bugs.gentoo.org/show_bug.cgi?id=97187 
CVE : 

#####################
Credits :
#####################

Eric Romang (eromang@zataz.net - ZATAZ Audit)
Thxs to Gentoo Security Team. (Taviso, jaervosz, solar, Koon, etc.)