Tarantella Enterprise 3 gunzip Race Condition Vulnerability
BID:3966
Info
Tarantella Enterprise 3 gunzip Race Condition Vulnerability
| Bugtraq ID: | 3966 |
| Class: | Race Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 26 2002 12:00AM |
| Updated: | Jan 26 2002 12:00AM |
| Credit: | Posted to BugTraq by Larry W. Cashdollar <[email protected]> on January 26, 2002. |
| Vulnerable: |
Tarantella Enterprise 3 3.20 0 Tarantella Enterprise 3 3.11 Tarantella Enterprise 3 3.10 Tarantella Enterprise 3 3.0 1 Tarantella Enterprise 3 3.0 |
| Not Vulnerable: | |
Discussion
Tarantella Enterprise 3 gunzip Race Condition Vulnerability
Tarantella Enterprise 3 is vulnerable to a race condition during the installation process. During installation, a root owned binary is created in /tmp (the directory specified by the $TMPDIR environment variable) with the name gunzip#### where #### is a PID. Prior to it being invoked by the installation program it can be overwritten by a local user. This is then run by the installation program with root privileges.
An attacker can only gain privileges in this manner if a privileged user is installing the software.
Tarantella Enterprise 3 is vulnerable to a race condition during the installation process. During installation, a root owned binary is created in /tmp (the directory specified by the $TMPDIR environment variable) with the name gunzip#### where #### is a PID. Prior to it being invoked by the installation program it can be overwritten by a local user. This is then run by the installation program with root privileges.
An attacker can only gain privileges in this manner if a privileged user is installing the software.
Exploit / POC
Tarantella Enterprise 3 gunzip Race Condition Vulnerability
An exploit has been provided by Larry Cashdollar <[email protected]>.
An exploit has been provided by Larry Cashdollar <[email protected]>.
Solution / Fix
Tarantella Enterprise 3 gunzip Race Condition Vulnerability
Solution:
Tarantella has announced that this issue will be fixed in the next release of Tarantella Enterprise 3.
Solution:
Tarantella has announced that this issue will be fixed in the next release of Tarantella Enterprise 3.