Multiple BSD FTS Directory Traversal Race Condition Vulnerability

Bugtraq ID:	3205
Class:	Race Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Aug 17 2001 12:00AM
Updated:	Aug 17 2001 12:00AM
Credit:	This vulnerability was announced in a FreeBSD Security Advisory on August 17, 2001.
Vulnerable:	OpenBSD OpenBSD 2.8 NetBSD NetBSD 1.5.1 NetBSD NetBSD 1.5 FreeBSD FreeBSD 4.3 -STABLE FreeBSD FreeBSD 4.3 -RELEASE
Not Vulnerable:	NetBSD NetBSD 1.5.2

Multiple BSD FTS Directory Traversal Race Condition Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Multiple BSD FTS Directory Traversal Race Condition Vulnerability

Solution:
Patches available:


NetBSD NetBSD 1.5

• NetBSD SA2001-016-fts.patch
  ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2001-016-fts.patch

NetBSD NetBSD 1.5.1

• NetBSD SA2001-016-fts.patch
  ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2001-016-fts.patch

OpenBSD OpenBSD 2.8

• OpenBSD 029_fts.patch
  ftp://ftp.openbsd.org/pub/OpenBSD/patches/2.8/common/029_fts.patch

FreeBSD FreeBSD 4.3 -STABLE

• FreeBSD fts.patch
  ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-01:40/fts.patch

FreeBSD FreeBSD 4.3 -RELEASE

• FreeBSD fts.patch
  ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-01:40/fts.patch

Multiple BSD FTS Directory Traversal Race Condition Vulnerability

References:

• 029: SECURITY FIX: May 30, 2001 (OpenBSD)