Summary
The remote host is missing an update to sysstat
announced via advisory DSA 460-2.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%20460-2
Insight
Alan Cox discovered that the isag utility (which graphically displays data collected by the sysstat tools), creates a temporary file without taking proper precautions. This vulnerability could allow a local attacker to overwrite files with the privileges of the user invoking isag.
The update used in DSA 460-1 did not fix every occurrence of the bug.
DSA 460-2 includes a more complete fix.
For the current stable distribution (woody) this problem has been fixed in version 4.0.4-1woody2.
For the unstable distribution (sid) this problem has been fixed in version 5.0.2-1.
We recommend that you update your sysstat package.
Severity
Classification
-
CVE CVE-2004-0108 -
CVSS Base Score: 4.6
AV:L/AC:L/Au:N/C:P/I:P/A:P
Related Vulnerabilities