OpenLDAP /usr/tmp/ Symlink Vulnerability

BID:1232

Info

OpenLDAP /usr/tmp/ Symlink Vulnerability

Bugtraq ID: 1232
Class: Race Condition Error
CVE:
Remote: No
Local: Yes
Published: Apr 21 2000 12:00AM
Updated: Apr 21 2000 12:00AM
Credit: This vulnerability was posted to the Bugtraq mailing list on April 22, 2000 in a RedHat Security Advisory.
Vulnerable: Turbolinux Turbolinux 6.0.2
Turbolinux Turbolinux 4.4
Turbolinux Turbolinux 4.2
Redhat openldap-1.2.9-5.i386.rpm
+ Redhat Linux 6.2
 Redhat openldap-1.2.7-2.i386.rpm
+ Redhat Linux 6.1
Redhat Linux 6.2 sparc
Redhat Linux 6.2 i386
Redhat Linux 6.2 alpha
Redhat Linux 6.1 sparc
Redhat Linux 6.1 i386
Redhat Linux 6.1 alpha
OpenLDAP OpenLDAP 1.2.10
OpenLDAP OpenLDAP 1.2.9
+ Redhat Linux 6.2 i386
 + Redhat Linux 6.2 i386
 + Redhat Linux 6.2
 OpenLDAP OpenLDAP 1.2.8
OpenLDAP OpenLDAP 1.2.7
Mandriva Linux Mandrake 7.0
Mandriva Linux Mandrake 6.1
Not Vulnerable:

Discussion

OpenLDAP /usr/tmp/ Symlink Vulnerability

A vulnerability exists in OpenLDAP as shipped with some versions of Linux, including RedHat 6.1 and 6.2, and TurboLinux 6.0.2 and earlier. OpenLDAP will create files in /usr/tmp, which is actually a symbolic link to the world writable /tmp directory. As OpenLDAP does not check for a files existence prior to opening the files in /usr/tmp, it is possible for an attacker to point an appropriately named symbolic link at any file on the filesystem, and cause it to be destroyed.

This vulnerability will also affect any Unix system with OpenLDAP assuming the following criteria is true:
1) slapd.conf configures the "directory" variable to be /usr/tmp
2) /usr/tmp is a world writable directory.
3) slurpd was built with the DEFAULT_SLURPD_REPLICA_DIR set to /usr/tmp

Exploit / POC

OpenLDAP /usr/tmp/ Symlink Vulnerability

ln -sf /etc/passwd /usr/tmp/NEXTID

Solution / Fix

OpenLDAP /usr/tmp/ Symlink Vulnerability

Solution:
Patches are available from RedHat and TurboLinux to remedy this problem.

Rebuilding OpenLDAP, and configuring the following values to something other than /usr/tmp will fix this problem:
servers/slapd/back-ldbm/back-ldbm.g, "DEFAULT_DB_DIRECTORY" variable
servers/slapd/slapd.conf, "directory" variable
servers/slurpd/slurp.h, "DEFAULT_SLURPD_REPLICA_DIR" variable

The latest version, 1.2.10, still appears vulnerable to this problem.


Redhat openldap-1.2.7-2.i386.rpm

Redhat openldap-1.2.9-5.i386.rpm

Turbolinux Turbolinux 6.0.2

Mandriva Linux Mandrake 6.1

Redhat Linux 6.1 i386

Redhat Linux 6.1 sparc

Redhat Linux 6.1 alpha

Redhat Linux 6.2 sparc

Redhat Linux 6.2 alpha

Redhat Linux 6.2 i386

Mandriva Linux Mandrake 7.0

References

OpenLDAP /usr/tmp/ Symlink Vulnerability

References:
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report