MacOSXLabs RsyncX Insecure Temporary File Creation Vulnerability

Bugtraq ID:	11212
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	Sep 17 2004 12:00AM
Updated:	Sep 17 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to Matt Johnston <[email protected]>.
Vulnerable:	MacOSXLabs RsyncX 2.1
Not Vulnerable:

MacOSXLabs RsyncX Insecure Temporary File Creation Vulnerability

RsyncX is reported to contain an insecure temporary file creation vulnerability. The result of this is that temporary files created by the application may use predictable filenames.

A local attacker may exploit this vulnerability to execute symbolic link file overwrite attacks.

MacOSXLabs RsyncX Insecure Temporary File Creation Vulnerability

The following example is available:

When using the scheduler component of RsyncX, /tmp/cron_rsyncxtmp
is insecurely used. A user can create a dir /tmp/blahdir,
then
ln -s /tmp/blahdir/file /tmp/cron.rsyncxtmp

After RsyncX scheduler is used by an admin, /etc/crontab
will become a symlink pointing to /tmp/blahdir/file.

MacOSXLabs RsyncX Insecure Temporary File Creation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

MacOSXLabs RsyncX Insecure Temporary File Creation Vulnerability

References:

• RsyncX Homepage (MacOSXLabs)
  
• RsyncX vulnerabilities (Matt Johnston )