/tmp Symlink Vulnerability with ZeroG's InstallAnywhere5
CVE ID(s):
CVE-none
Notified: 2002-12-20
Description:
InstallAnywhere (www.zerog.com) is a software framework that simplifies software installation on multiple client and server platforms. This software is utilized by such vendors like LimeWire (www.limewire.org). During execution this software insecurely creates two file in /tmp that can be used to clobber system files through symlink attacks. During the creation of one file a race condition exists to determine the filename the other requires no guesswork.
Notes:
8236