Test ID:	1.3.6.1.4.1.25623.1.0.51927
Category:	Ubuntu Local Security Checks
Title:	Ubuntu 4.10 USN-100-1 (cdrtools)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to cdrtools announced via advisory USN-100-1. Javier Fernandez-Sanguino Pena noticed that cdrecord created temporary files in an insecure manner if DEBUG was enabled in /etc/cdrecord/rscsi. If the default value was used (which stored the debug output file in /tmp), this could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking cdrecord. Please note that DEBUG is not enabled by default in Ubuntu, so if you did not explicitly enable it, this does not affect you. The following packages are affected: cdrecord Solution: The problem can be corrected by upgrading the affected package to version 4:2.0+a30.pre1-1ubuntu2.2. In general, a standard system upgrade is sufficient to effect the necessary changes. http://www.securityspace.com/smysecure/catid.html?in=USN-100-1 http://bugs.debian.org/291376 Risk factor : High
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.