#########################################################

xpvm insecure temporary files creation

Vendor: http://www.csm.ornl.gov/pvm/pvm_home.html 
Advisory: http://www.zataz.net/adviso/xpvm-06272005.txt
Vendor informed: yes
Exploit available: yes
Impact : low
Exploitation : low

#########################################################

The vulnerability is caused due to temporary file being created insecurely.
This can be exploited via symlink attacks in combination  to create and overwrite arbitrary
files with the privileges of the user running the affected script.

##########
Versions:
##########

xpvm <= 1.2.5-r2

##########
Solution:
##########

To prevent symlink attack use kernel patch such as grsecurity

#########
Timeline:
#########

Discovered : 2005-06-27
Vendor notified : 2005-07-12
Vendor response : 
Vendor fix : 
Vendor Sec report (vendor-sec@lst.de) : 
Disclosure :  

#####################
Technical details :
#####################

Vulnerable code :
-----------------

ake a look at

src/xpvm.tcl :

158 #
159 # Get User Name
160 #
161 
162 set user [ get_user_name ]

832 if { $tfck == 0 } { set trace_file "/tmp/xpvm.trace.$user" }

834 $CTRL.file_entry insert 0 $trace_file

#########
Related :
#########

Bug report : http://bugs.gentoo.org/show_bug.cgi?id=97184 
CVE : 

#####################
Credits :
#####################

Eric Romang (eromang@zataz.net - ZATAZ Audit)
Thxs to Gentoo Security Team. (Taviso, jaervosz, solar, Koon, etc.)