CVE-2002-2382: Improper Link Resolution Before File Access

cvsupd.sh in CVSup 1.2 allows local users to overwrite arbitrary files and gain privileges via a symlink attack on /var/tmp/cvsupd.out...

cvsupd-startup.txt

Hi, Better not to file a PR for this, I feel. I was just passing by net/cvsup-mirror/files/cvsupd.sh when I noticed that it appends to the fixed-name file /var/tmp/cvsupd.out Therefore if I were a malicious user, I could make a symlink of that name in /var/tmp to effect arbitrary file corruption...