sm-sorcery-bugs AT lists.ibiblio.org
Subject: Bugs for Sorcery are reported here
List archive
[SM-Sorcery-Bugs] [Bug 7528] [security] : insecure tmp file handling vulnerability ($F_TMP)
- From: bugzilla-daemon AT metalab.unc.edu
- To: sm-sorcery-bugs AT lists.ibiblio.org
- Subject: [SM-Sorcery-Bugs] [Bug 7528] [security] : insecure tmp file handling vulnerability ($F_TMP)
- Date: Sun, 17 Oct 2004 05:33:27 -0400
http://bugs.sourcemage.org/show_bug.cgi?id=7528
------- Additional Comments From cykl AT madchat.org 2004-10-17 05:33 -------
> Also I fail to see how this is even remotely exploitable, we copy the
install log to a file in /tmp
Yes, but if $F_TMP already exist and is a symlink ?
===================
(11:27) (cmathieu@ragondin) > cd tmp
(11:27) (cmathieu@ragondin) > echo "plop" > plop
(11:27) (cmathieu@ragondin) > ln -s plop kernel.1234.245
(11:28) (cmathieu@ragondin) > cp /etc/hosts kernel.1234.245
(11:28) (cmathieu@ragondin) > cat plop
#
# hosts This file describes a number of hostname-to-address
# mappings for the TCP/IP subsystem. It is mostly
[snip]
====================
If you can predict the $F_TMP value you can erase any file.
> we copy the install log to a file in /tmp, thus overwriting whatever the
attacker has in it
Do you know symlinks ?
> then they get about 1/4 of a second to put something dirty in it
It is not a race condition but a brute force attack. It is never checked if
$F_TMP already exist.
And yes you need to be lucky/patient :-)
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
- [SM-Sorcery-Bugs] [Bug 7528] [security] : insecure tmp file handling vulnerability ($F_TMP), bugzilla-daemon, 10/17/2004
Archive powered by MHonArc 2.6.24.