GCC 2.7.2 Symlink Vulnerability
BID:146
Info
GCC 2.7.2 Symlink Vulnerability
| Bugtraq ID: | 146 |
| Class: | Race Condition Error |
| CVE: |
CVE-1999-1439 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 02 1998 12:00AM |
| Updated: | Jul 11 2009 12:16AM |
| Credit: | This vulnerability was originally posted to bugtraq by Richard Kenny <[email protected]> on January 2, 1998. |
| Vulnerable: |
GNU gcc 2.7.2 |
| Not Vulnerable: | |
Discussion
GCC 2.7.2 Symlink Vulnerability
The exploitation of the GNU gcc 2.7.2 symlink vulnerability appeared when it was realized gcc followed symbolic links during the accessing of temporary files in /tmp. The symlinks that are followed by gcc when the vulnerability is exploited are created by the attacker with predicted filenames. The consequence of the vulnerability being exploited is the ability for the attacker to "destroy" any file he has access to. The file is destroyed in the sense that, when the symlink is followed, the 'temporary file' (which points to the target file), is written to by gcc. There is a possibility the attacker may be able to write arbritrary data to some files and gain local root access.
The exploitation of the GNU gcc 2.7.2 symlink vulnerability appeared when it was realized gcc followed symbolic links during the accessing of temporary files in /tmp. The symlinks that are followed by gcc when the vulnerability is exploited are created by the attacker with predicted filenames. The consequence of the vulnerability being exploited is the ability for the attacker to "destroy" any file he has access to. The file is destroyed in the sense that, when the symlink is followed, the 'temporary file' (which points to the target file), is written to by gcc. There is a possibility the attacker may be able to write arbritrary data to some files and gain local root access.
Exploit / POC
GCC 2.7.2 Symlink Vulnerability
To exploit this vulnerability, the attacker would have to create symlinks with names of predicted gcc temporary files. The symlinks would have to point to the target file(s) which would be overwritten. In all likelyhood, gcc would have to be run several times before one of the created symlinks is followed.
To exploit this vulnerability, the attacker would have to create symlinks with names of predicted gcc temporary files. The symlinks would have to point to the target file(s) which would be overwritten. In all likelyhood, gcc would have to be run several times before one of the created symlinks is followed.
Solution / Fix
GCC 2.7.2 Symlink Vulnerability
Solution:
Obtain the newest version of gcc if you believe you are vulnerable to this attack. Until you upgrade, it's especially important not to run gcc as root. This could lead to a possible root compromise. GCC is a product of the GNU project and the newest version can be found at ftp://ftp.gnu.org/pub.
Solution:
Obtain the newest version of gcc if you believe you are vulnerable to this attack. Until you upgrade, it's especially important not to run gcc as root. This could lead to a possible root compromise. GCC is a product of the GNU project and the newest version can be found at ftp://ftp.gnu.org/pub.