Pax File Permission Modification Race Condition Weakness

Bugtraq ID:	15262
Class:	Race Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Nov 01 2005 12:00AM
Updated:	Nov 01 2005 12:00AM
Credit:	The original discoverer of this issue is currently unknown.
Vulnerable:	OpenBSD OpenBSD 2.9 OpenBSD OpenBSD 2.8 OpenBSD OpenBSD 2.7 OpenBSD OpenBSD 2.6 OpenBSD OpenBSD 2.5 OpenBSD OpenBSD 2.4 OpenBSD OpenBSD 2.3 OpenBSD OpenBSD 2.2 OpenBSD OpenBSD 2.1 OpenBSD OpenBSD 2.0 OpenBSD OpenBSD 3.7 OpenBSD OpenBSD 3.6 OpenBSD OpenBSD 3.5 OpenBSD OpenBSD 3.4 OpenBSD OpenBSD 3.3 OpenBSD OpenBSD 3.2 OpenBSD OpenBSD 3.1 OpenBSD OpenBSD 3.0 Keith Muller pax
Not Vulnerable:	OpenBSD OpenBSD 3.8

Pax File Permission Modification Race Condition Weakness

Pax is reported prone to a security weakness; the issue is only present when an archive is extracted into a world or group writable directory. It is reported that pax employs non-atomic procedures to write a file and later change the permissions on the newly extracted file.

A local attacker may leverage this issue to modify file permissions of target files.

Pax File Permission Modification Race Condition Weakness

No exploit is required.

Pax File Permission Modification Race Condition Weakness

Solution:
OpenBSD has released version 3.8 of the OpenBSD operating system to address this issue.

Pax File Permission Modification Race Condition Weakness

References:

• CVS: cvs.openbsd.org: src (Otto Moerbeek )
  
• OpenBSD 3.8 Release (OpenBSD)