Users login

Create an account »


Users login

Home » Security Advisories» Debian » Lm-sensors insecure temp file

Lm-sensors insecure temp file

Javier Fernández-Sanguino Peña discovered that a script of lm-sensors, utilities to read temperature/voltage/fan sensors, creates a temporary file with a predictable filename, leaving it vulnerable for a symlink attack.

  • Vendor: Debian
  • Vendor ID: DSA 814-1
  • Date: September 15, 2005

Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 814-1 [email protected] Martin Schulze
September 15th, 2005
- --------------------------------------------------------------------------

Package : lm-sensors
Vulnerability : insecure temporary file
Problem type : local
Debian-specific: no
CVE ID : CAN-2005-2672]
Debian Bug : 324193

Javier Fernández-Sanguino Peña discovered that a script of lm-sensors,
utilities to read temperature/voltage/fan sensors, creates a temporary
file with a predictable filename, leaving it vulnerable for a symlink

The old stable distribution (woody) is not affected by this problem.

For the stable distribution (sarge) this problem has been fixed in
version 2.9.1-1sarge2.

For the unstable distribution (sid) this problem has been fixed in
version 2.9.1-7.

We recommend that you upgrade your lm-sensors package.

Upgrade Instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.1 alias sarge
- --------------------------------

Source archives:
Size/MD5 checksum: 1089 b29b66e67c0cdc230e00e5183724427a
Size/MD5 checksum: 32896 551c338fbc31a17f7fd909c8c18f495e
Size/MD5 checksum: 870765 f5af615e39441d95471bdb72a3f01709

Architecture independent components:
Size/MD5 checksum: 304604 9b936604bcb60dd90c26de965bc8ae7f
Size/MD5 checksum: 956166 a4cc7cf62245912cca061249e7ff153e

Alpha architecture:
Size/MD5 checksum: 107734 6672ce70e0a11a3db57b5cc5410a887f
Size/MD5 checksum: 88004 07333a65127b12aaa3bb7593ca998fc8
Size/MD5 checksum: 469638 2894c427fa1a171588ee25ec7944aeae
Size/MD5 checksum: 60162 996e3f4caa6f99a509612ed9409538a1

AMD64 architecture:
Size/MD5 checksum: 99604 5a2ecb59416841693f291c18ffc36b9f
Size/MD5 checksum: 86024 be04743cfbe7a3dba14522ce35807a46
Size/MD5 checksum: 471644 de8c9584f1d5bc2a2fc4134ebb0a5958
Size/MD5 checksum: 57960 7d2bcf38f644cc293814d9be97e7e462

ARM architecture:
Size/MD5 checksum: 95374 76afc070abfaca6877c53b3dc97e2efe
Size/MD5 checksum: 77598 688a884f1c1a3d9966863f9dd13e6378
Size/MD5 checksum: 466524 f60ec616c55ffecd7d32d9ce6701520b
Size/MD5 checksum: 56518 001487c8ebf59a64eca3c4b1ebd3a4fc

Intel IA-32 architecture:
Size/MD5 checksum: 93822 18985e4483e7ba7f1ee4e08c31e77ee6
Size/MD5 checksum: 77704 c7360febfe8fb136d4edc7447c4a3787
Size/MD5 checksum: 471594 4bb236b1ad878a31115d7231f624d53b
Size/MD5 checksum: 258638 9dab2f0c6ca40bb6b1fa648c72dea266
Size/MD5 checksum: 258646 27ec0369b7e5710cfa9b8a2f6dc7f976
Size/MD5 checksum: 258638 7b59494c8c7e836392ec8d29832a37f7
Size/MD5 checksum: 259220 1f84862f63d4b84ca52d3b0188eae27f
Size/MD5 checksum: 258658 f44895c10b0a2a66f9f8fc2fc1c08945
Size/MD5 checksum: 258950 fc63b5a3190378d192810b865db159d7
Size/MD5 checksum: 259496 acbd3d286c9f83c33075207a32297bfe
Size/MD5 checksum: 56282 4aaa87fa8ec4a9c7a80cc5fa2a2a65c7

Intel IA-64 architecture:
Size/MD5 checksum: 110518 31b9a4a92124027fc290af68a33c9d72
Size/MD5 checksum: 94704 1c7b33cb67d43b00bc5c560e010cba42
Size/MD5 checksum: 487502 b2c2e822feccd91e2cf4e16b788ee8b2
Size/MD5 checksum: 63894 6f5dd42f2e9bfe4e6f6dfc0d657c231c

HP Precision architecture:
Size/MD5 checksum: 103444 b90312374564a949899f1fc5efe0afca
Size/MD5 checksum: 88110 c2c6817f83c05784e7ae6dfb342c3f45
Size/MD5 checksum: 470520 cff17a1708ab3698cbe576845758f040
Size/MD5 checksum: 59432 2316f77020a58c9bbcb4680e39093872

Motorola 680x0 architecture:
Size/MD5 checksum: 95016 2570abfafb354bf68ff57e294010d9bd
Size/MD5 checksum: 82760 8575a48b3ae56c05aa33b1dec7b7e7d8
Size/MD5 checksum: 457278 2b04efc7078bfcac49bae53de1fa37f4
Size/MD5 checksum: 55334 acf8cedc0bc7b9fcce51bf4028346aa4

Big endian MIPS architecture:
Size/MD5 checksum: 101340 65525f23eed1bb8bd56104db43613b64
Size/MD5 checksum: 80346 78e1796d19b2a450001b7db46fa00971
Size/MD5 checksum: 464976 77c81982d7dc7a6e3059e9b7bfe843ae
Size/MD5 checksum: 58392 fce20208178fcf5e8b34f037a89ebeb8

Little endian MIPS architecture:
Size/MD5 checksum: 99308 561831d67a0b6c5a2c23ce19d63fd4e9
Size/MD5 checksum: 78318 bf864fc9cc93f35f74cb383916b93187
Size/MD5 checksum: 465612 90be081b2fe5d58208cdc22f922ace6a
Size/MD5 checksum: 58452 862e8a3b5f5bf5ab9a7e37f91828a96a

PowerPC architecture:
Size/MD5 checksum: 105926 1c01fa48983ca51785fb6cebcb1352e7
Size/MD5 checksum: 84122 362b899e12a413c46a1aa3bb80ae9564
Size/MD5 checksum: 476730 326fe3274869079637c4a425430d9cc9
Size/MD5 checksum: 59362 2be27fc39b66107b8bc28df51bfd929f

IBM S/390 architecture:
Size/MD5 checksum: 105122 aa913f7a24298b97954809094c966d13
Size/MD5 checksum: 86884 2c6ebcada8848923a727f21d348089bf
Size/MD5 checksum: 463706 d0d5e649c114bd891c9dd5a742b3dd7f
Size/MD5 checksum: 57970 fccda7621dfee8331517dc5f47587246

Sun Sparc architecture:
Size/MD5 checksum: 100274 63098e8e9f4c3fab8147c04aa17d811c
Size/MD5 checksum: 80906 18db5ab878c2185c7a999f968b36e204
Size/MD5 checksum: 470238 3edce01e75344d0a8a3985c564060243
Size/MD5 checksum: 56654 c47257c9c9263f657a3e96f55b14c40b

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb stable/updates main
For dpkg-ftp: dists/stable/updates/main
Mailing list: [email protected]
Package info: `apt-cache show ' and;

Version: GnuPG v1.4.1 (GNU/Linux)


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.


Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »