Skip to Content.
Sympa Menu

sm-sorcery-bugs - [SM-Sorcery-Bugs] [Bug 7528] [security] : insecure tmp file handling vulnerability ($F_TMP)

sm-sorcery-bugs AT lists.ibiblio.org

Subject: Bugs for Sorcery are reported here

List archive

Chronological Thread  
  • From: bugzilla-daemon AT metalab.unc.edu
  • To: sm-sorcery-bugs AT lists.ibiblio.org
  • Subject: [SM-Sorcery-Bugs] [Bug 7528] [security] : insecure tmp file handling vulnerability ($F_TMP)
  • Date: Sun, 17 Oct 2004 05:33:27 -0400

http://bugs.sourcemage.org/show_bug.cgi?id=7528





------- Additional Comments From cykl AT madchat.org 2004-10-17 05:33 -------
> Also I fail to see how this is even remotely exploitable, we copy the
install log to a file in /tmp

Yes, but if $F_TMP already exist and is a symlink ?

===================
(11:27) (cmathieu@ragondin) > cd tmp
(11:27) (cmathieu@ragondin) > echo "plop" > plop
(11:27) (cmathieu@ragondin) > ln -s plop kernel.1234.245
(11:28) (cmathieu@ragondin) > cp /etc/hosts kernel.1234.245
(11:28) (cmathieu@ragondin) > cat plop
#
# hosts This file describes a number of hostname-to-address
# mappings for the TCP/IP subsystem. It is mostly
[snip]
====================

If you can predict the $F_TMP value you can erase any file.

> we copy the install log to a file in /tmp, thus overwriting whatever the
attacker has in it

Do you know symlinks ?

> then they get about 1/4 of a second to put something dirty in it

It is not a race condition but a brute force attack. It is never checked if
$F_TMP already exist.

And yes you need to be lucky/patient :-)



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.



  • [SM-Sorcery-Bugs] [Bug 7528] [security] : insecure tmp file handling vulnerability ($F_TMP), bugzilla-daemon, 10/17/2004

Archive powered by MHonArc 2.6.24.

Top of Page