CVE-2008-3521: jasper_project jasper Link Following

Vulnerability summary

CVE-2008-3521 is a high (CVSS 7.2) Link Following vulnerability in jasper_project jasper. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 38.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 02-10-2008
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

Race condition in the jas_stream_tmpfile function in libjasper/base/jas_stream.c in JasPer 1.900.1 allows local users to cause a denial of service (program exit) by creating the appropriate tmp.XXXXXXXXXX temporary file, which causes Jasper to exit. NOTE: this was originally reported as a symlink issue, but this was incorrect. NOTE: some vendors dispute the severity of this issue, but it satisfies CVE's requirements for inclusion.

• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.