BID:3960

sort Insecure Temporary File Denial of Service Vulnerability

Info

sort Insecure Temporary File Denial of Service Vulnerability

Bugtraq ID:	3960
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	No
Local:	Yes
Published:	Jan 29 2001 12:00AM
Updated:	Jan 29 2001 12:00AM
Credit:	Discovered in a FreeBSD security audit and published in the advisory FreeBSD-SA-01:13.
Vulnerable:	SGI IRIX 6.5.15 m SGI IRIX 6.5.15 f SGI IRIX 6.5.14 m SGI IRIX 6.5.14 f SGI IRIX 6.5.13 m SGI IRIX 6.5.13 f SGI IRIX 6.5.12 m SGI IRIX 6.5.12 f SGI IRIX 6.5.11 m SGI IRIX 6.5.11 f SGI IRIX 6.5.10 SGI IRIX 6.5.9 SGI IRIX 6.5.8 SGI IRIX 6.5.7 SGI IRIX 6.5.6 SGI IRIX 6.5.5 SGI IRIX 6.5.4 SGI IRIX 6.5.3 SGI IRIX 6.5.2 SGI IRIX 6.5.1 SGI IRIX 6.5 FreeBSD FreeBSD 4.1.1 FreeBSD FreeBSD 4.1 FreeBSD FreeBSD 4.0 FreeBSD FreeBSD 3.5.1 FreeBSD FreeBSD 3.5 FreeBSD FreeBSD 3.4 FreeBSD FreeBSD 3.3 FreeBSD FreeBSD 3.2 FreeBSD FreeBSD 3.1 FreeBSD FreeBSD 3.0 Caldera UnixWare 7.1.1 Caldera UnixWare 7.1 .0 Caldera OpenUnix 8.0 Caldera OpenServer 5.0.6 Caldera OpenServer 5.0.5 Apple Mac OS X 10.1

Not Vulnerable:

Discussion

sort Insecure Temporary File Denial of Service Vulnerability

sort is a common Unix utility which will sort text files by line. sort was originally included in Version 5 AT&T Unix, and it may be safely assumed that it is included in all current Unix distributions.

Some versions of sort are dependant on the ability to create a temporary file with a predictable name. An attacker able to create this file ahead of sort will be able to deny the usage of the utility to other local users, and possibly impede the functionality of automated system tasks.

Exploit / POC

sort Insecure Temporary File Denial of Service Vulnerability

No exploit code is required to take advantage of this issue.

Solution / Fix

sort Insecure Temporary File Denial of Service Vulnerability

Solution:
Apple has released a fix, available through their Software Update service.

Vendor patches are available:

FreeBSD FreeBSD 3.5.1