IBM Concert Temporary File Overwrite Vulnerability via Symlink Attack

A vulnerability exists in IBM Concert versions 1.0.0 through 2.2.0, where the software creates temporary files with predictable names. This flaw allows local users to overwrite arbitrary files by exploiting the predictable file naming through a symlink attack.

Impact

Exploitation of this vulnerability could lead to unauthorized overwriting of files, potentially causing data loss or corruption.

Remediation

Users are advised to upgrade to IBM Concert Software version 2.3.1. This version can be downloaded from the Container software library section of the IBM Entitled Registry (ICR) and installed following the provided instructions for the type of deployment.