IM-Switch Insecure Temporary File Handling Symbolic Link Vulnerability
BID:10717
Info
IM-Switch Insecure Temporary File Handling Symbolic Link Vulnerability
| Bugtraq ID: | 10717 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jul 13 2004 12:00AM |
| Updated: | Jul 13 2004 12:00AM |
| Credit: | Discovery of this vulnerability is credited to SEKINE Tatsuo. |
| Vulnerable: |
Redhat Fedora Core2 Redhat Fedora Core1 im-switch im-switch |
| Not Vulnerable: | |
Discussion
IM-Switch Insecure Temporary File Handling Symbolic Link Vulnerability
It is reported that im-switch is prone to a local insecure temporary file handling symbolic link vulnerability. This issue is due to a design error that allows the application to insecurely write to a temporary file that is created with a predictable file name.
The im-switch utility will write to this temporary file before verifying its existence; this would facilitate a symbolic link attack.
An attacker may exploit this issue to corrupt arbitrary files. This corruption may potentially result in the elevation of privileges, or in a system wide denial of service.
It is reported that im-switch is prone to a local insecure temporary file handling symbolic link vulnerability. This issue is due to a design error that allows the application to insecurely write to a temporary file that is created with a predictable file name.
The im-switch utility will write to this temporary file before verifying its existence; this would facilitate a symbolic link attack.
An attacker may exploit this issue to corrupt arbitrary files. This corruption may potentially result in the elevation of privileges, or in a system wide denial of service.
Exploit / POC
IM-Switch Insecure Temporary File Handling Symbolic Link Vulnerability
The following example is available:
$ bash -c 'i=1;while [ $i -lt 65536 ]; do ln -s /etc/IMPORTANT_FILE
/tmp/imswitcher$i; let "i++"; done'
The following example is available:
$ bash -c 'i=1;while [ $i -lt 65536 ]; do ln -s /etc/IMPORTANT_FILE
/tmp/imswitcher$i; let "i++"; done'
Solution / Fix
IM-Switch Insecure Temporary File Handling Symbolic Link Vulnerability
Solution:
It is reported that this vulnerability is addressed by the following package for RedHat Fedora Core 2:
Redhat Fedora Core2
Solution:
It is reported that this vulnerability is addressed by the following package for RedHat Fedora Core 2:
Redhat Fedora Core2
-
RedHat im-sdk-11.4-46.1.svn1587.src.rpm
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/i386 /SRPMS/im-sdk-11.4-46.1.svn1587.src.rpm
References
IM-Switch Insecure Temporary File Handling Symbolic Link Vulnerability
References:
References: