Jason Hoover

**Name of the Vulnerable Software and Affected Versions** PADL MigrationTools version 46 **Description** The issue allows local users to overwrite arbitrary files via a symlink attack on temporary files. This is due to the insecure creation of temporary files by several scripts, including `migrate all online.sh`, `migrate all offline.sh`, `migrate all netinfo online.sh`, `migrate all netinfo offline.sh`, `migrate all nis online.sh`, `migrate all nis offline.sh`, `migrate all nisplus online.sh`, and `migrate all nisplus offline.sh`. **Recommendations** As a temporary workaround, consider restricting access to the temporary files created by the affected scripts until a patch is available. Avoid using the affected scripts until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PADL MigrationTools version 46 **Description** The issue concerns the storage of sensitive information in temporary files when a failure occurs. Specifically, the contents of /etc/shadow are stored in a world-readable /tmp/nis.$$.ldif file. Other sensitive information may also be stored in temporary files. The scripts migrate all online.sh, migrate all offline.sh, migrate all netinfo online.sh, migrate all netinfo offline.sh, migrate all nis online.sh, migrate all nis offline.sh, migrate all nisplus online.sh, and migrate all nisplus offline.sh do not properly manage these temporary files. **Recommendations** As a temporary workaround, consider restricting access to the temporary files generated by the affected scripts until a proper fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.