RedHat dhcp Symbolic Link Vulnerability
BID:368
Info
RedHat dhcp Symbolic Link Vulnerability
| Bugtraq ID: | 368 |
| Class: | Origin Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Mar 09 1998 12:00AM |
| Updated: | Mar 09 1998 12:00AM |
| Credit: | First posted to BugTraq by Mark A. Spencer <[email protected]> on March 9, 1998. |
| Vulnerable: |
Redhat Linux 5.0 |
| Not Vulnerable: |
Redhat Linux 6.0 Redhat Linux 5.2 i386 Redhat Linux 5.1 |
Discussion
RedHat dhcp Symbolic Link Vulnerability
When configuring a dhcp interface in RedHat Linux 5.0, a script is called at the end that copies /etc/dhcpc/resolv.conf to /etc as shown below:
if [ -f /etc/dhcpc/resolv.conf ]; then
echo "setting up resolv.conf" >> /tmp/dhcplog
cp /etc/dhcpc/resolv.conf /etc
fi
Since the script runs as root, if /tmp/dhcplog is a symbolic link, any file pointed to by the dhcplog symlink be appended by "setting up resolv.conf".
When configuring a dhcp interface in RedHat Linux 5.0, a script is called at the end that copies /etc/dhcpc/resolv.conf to /etc as shown below:
if [ -f /etc/dhcpc/resolv.conf ]; then
echo "setting up resolv.conf" >> /tmp/dhcplog
cp /etc/dhcpc/resolv.conf /etc
fi
Since the script runs as root, if /tmp/dhcplog is a symbolic link, any file pointed to by the dhcplog symlink be appended by "setting up resolv.conf".
Exploit / POC
RedHat dhcp Symbolic Link Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
RedHat dhcp Symbolic Link Vulnerability
Solution:
It was fixed in initscripts-3.2 and RedHat 5.1.
Solution:
It was fixed in initscripts-3.2 and RedHat 5.1.
References
RedHat dhcp Symbolic Link Vulnerability
References:
References: