D--

Name of the Vulnerable Software and Affected Versions: foo2zjs versions prior to 20110722dfsg-3ubuntu1 foo2zjs version 20110722dfsg-1 foo2zjs version 20090908dfsg-5.1+squeeze0 Description: The issue allows local users to write over arbitrary files via a symlink attack on /tmp/foo2zjs, due to insecure creation of temporary files. Recommendations: For foo2zjs version 20110722dfsg-1, update to a version later than 20110722dfsg-1 to resolve the issue. For foo2zjs version 20090908dfsg-5.1+squeeze0, update to a version later than 20090908dfsg-5.1+squeeze0 to resolve the issue. For foo2zjs versions prior to 20110722dfsg-3ubuntu1, update to version 20110722dfsg-3ubuntu1 or later to resolve the issue.

The issue concerns the failure to validate the server certificate when downloading PPA GPG key fingerprints. This allows man-in-the-middle (MITM) attackers to spoof GPG keys for a package repository.

The issue allows man-in-the-middle attackers to create or overwrite arbitrary files via a directory traversal attack using a crafted tar file, or bypass authentication via a crafted meta-release file, due to the lack of GPG signature verification before extracting an upgrade tarball.

The issue allows local users to write to arbitrary files via a symlink attack on the HH LOG file or the REPORT LOG file.