Debian DSA-037-1 : Athena Widget replacement libraries - insecure tempfile handling

2004-09-29T00:00:00
ID DEBIAN_DSA-037.NASL
Type nessus
Reporter Tenable
Modified 2013-05-17T00:00:00

Description

It has been reported that the AsciiSrc and MultiSrc widget in the Athena widget library handle temporary files insecurely. Joey Hess has ported the bugfix from XFree86 to these Xaw replacements libraries. The fixes are available in nextaw 0.5.1-34potato1, xaw3d 1.3-6.9potato1, and xaw95 1.1-4.6potato1.

                                        
                                            #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-037. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(14874);
  script_version("$Revision: 1.13 $");
  script_cvs_date("$Date: 2013/05/17 23:36:50 $");

  script_xref(name:"DSA", value:"037");

  script_name(english:"Debian DSA-037-1 : Athena Widget replacement libraries - insecure tempfile handling");
  script_summary(english:"Checks dpkg output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"It has been reported that the AsciiSrc and MultiSrc widget in the
Athena widget library handle temporary files insecurely. Joey Hess has
ported the bugfix from XFree86 to these Xaw replacements libraries.
The fixes are available in nextaw 0.5.1-34potato1, xaw3d
1.3-6.9potato1, and xaw95 1.1-4.6potato1."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.debian.org/security/2001/dsa-037"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Upgrade the affected nextaw, xaw3d, and xaw95 packages."
  );
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:nextaw");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xaw3d");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:xaw95");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:2.2");

  script_set_attribute(attribute:"patch_publication_date", value:"2001/03/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2004/09/29");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2004-2013 Tenable Network Security, Inc.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"2.2", prefix:"nextaw", reference:"0.5.1-34potato1")) flag++;
if (deb_check(release:"2.2", prefix:"nextawg", reference:"0.5.1-34potato1")) flag++;
if (deb_check(release:"2.2", prefix:"xaw3d", reference:"1.3-6.9potato1")) flag++;
if (deb_check(release:"2.2", prefix:"xaw3dg", reference:"1.3-6.9potato1")) flag++;
if (deb_check(release:"2.2", prefix:"xaw3dg-dev", reference:"1.3-6.9potato1")) flag++;
if (deb_check(release:"2.2", prefix:"xaw95g", reference:"1.1-4.6potato1")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");