Arbitrary File Overwrite in syncevolution
Summary
CVE-2014-1639: syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwr... Affects syncevolution versions < 1.3.99.7-1. Fixed in 1.3.99.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
syncevolution is a package used for synchronizing personal information management (PIM) data between various devices and services. It provides a command-line interface and supports multiple protocols. However, a vulnerability has been discovered in syncevolution versions prior to 1.3.99.7 that allows local users to overwrite arbitrary files on the system.
Vulnerability Detail
The vulnerability (CVE-2014-1639) exists in the 'installcheck-local.sh' script of syncevolution. This script uses 'mktemp' to create a temporary file, but it appends a suffix to the original filename and writes to the new filename. This behavior can be exploited by local users to perform a symlink attack and overwrite arbitrary files on the system. By creating a symbolic link to a sensitive file, an attacker can trick the script into overwriting that file with malicious content.
How To Fix
Minimum fixed version
1.3.99.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade syncevolutionTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually modify the 'installcheck-local.sh' script to ensure that temporary files are created and written securely. One possible modification is to use the 'mktemp' command with the '--tmpdir' option to specify a secure temporary directory. For example:
# Replace:
mktemp
# With:
mktemp --tmpdir=/tmp
Conclusion
The vulnerability in syncevolution versions prior to 1.3.99.7 allows local users to overwrite arbitrary files on the system through a symlink attack. To mitigate this risk, it is recommended to update syncevolution to the latest version. Users can also use the Vulert Playground to check if their system is affected by this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for syncevolution →
FAQ
syncevolution is a package used for synchronizing personal information management (PIM) data between various devices and services. It supports multiple protocols and provides a command-line interface.
The vulnerability allows local users to overwrite arbitrary files on the system. This can lead to unauthorized modification or destruction of sensitive data, potential privilege escalation, or disruption of system functionality.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the playground will analyze it for known vulnerabilities.
There are no known public exploits specifically targeting this vulnerability at the time of this report. However, it is important to promptly apply the recommended fix to mitigate the risk of exploitation.
For more information about this vulnerability, you can refer to the CVE-2014-1639 entry in the National Vulnerability Database (NVD) at https://nvd.nist.gov/vuln/detail/CVE-2014-1639.
Related vulnerabilities
Recent vulnerabilities recorded for syncevolution.
