GNU screen Insecure Temporary File Creation Vulnerability
BID:34521
Info
GNU screen Insecure Temporary File Creation Vulnerability
| Bugtraq ID: | 34521 |
| Class: | Design Error |
| CVE: |
CVE-2009-1214 CVE-2009-1215 |
| Remote: | No |
| Local: | Yes |
| Published: | Mar 25 2009 12:00AM |
| Updated: | Apr 16 2015 05:49PM |
| Credit: | Debian |
| Vulnerable: |
Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 RedHat Enterprise Linux WS 5 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux WS 3 RedHat Enterprise Linux WS 2.1 IA64 RedHat Enterprise Linux WS 2.1 RedHat Enterprise Linux ES 4 RedHat Enterprise Linux ES 3 RedHat Enterprise Linux ES 2.1 IA64 RedHat Enterprise Linux ES 2.1 Red Hat Enterprise Linux AS 4 Red Hat Enterprise Linux AS 3 Red Hat Enterprise Linux AS 2.1 IA64 Red Hat Enterprise Linux AS 2.1 GNU screen 4.0.3 GNU screen 4.0.2 GNU screen 4.0.1 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 |
| Not Vulnerable: | |
Discussion
GNU screen Insecure Temporary File Creation Vulnerability
GNU 'screen' creates a temporary file in an insecure manner.
An attacker with local access could obtain sensitive information or perform symbolic-link attacks to overwrite arbitrary files in the context of the affected application.
Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in a denial of service. Other attacks may also be possible.
This issue affects GNU 'screen' 4.0.3; other versions may also be affected.
GNU 'screen' creates a temporary file in an insecure manner.
An attacker with local access could obtain sensitive information or perform symbolic-link attacks to overwrite arbitrary files in the context of the affected application.
Successfully mounting a symlink attack may allow the attacker to delete or corrupt sensitive files, which may result in a denial of service. Other attacks may also be possible.
This issue affects GNU 'screen' 4.0.3; other versions may also be affected.
Exploit / POC
GNU screen Insecure Temporary File Creation Vulnerability
An attacker uses readily available commands to launch attacks.
An attacker uses readily available commands to launch attacks.
Solution / Fix
GNU screen Insecure Temporary File Creation Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
GNU screen Insecure Temporary File Creation Vulnerability
References:
References:
- #521123 - /tmp/screen-exchange still unsafe - Debian Bug report logs (Kees Cook)
- bug #25296: [Patch] Insecure creation of /tmp/screen-exchange (symlink attack) (GNU)
- Bug #315993 in screen (Ubuntu): �??Insecure creation of /tmp/screen-exchange (syml (Jan Minár)
- CVE request -- zsh, XFree86-xfs/xorg-x11-xfs, screen (Jan Lieskovsky)
- GNU Screen Homepage (GNU)
- Jan Lieskovsky (Red Hat)