BRU SetLicense Script Insecure Temporary File Symbolic Link Vulnerability
BID:3970
Info
BRU SetLicense Script Insecure Temporary File Symbolic Link Vulnerability
| Bugtraq ID: | 3970 |
| Class: | Access Validation Error |
| CVE: |
CVE-2002-0210 |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 26 2002 12:00AM |
| Updated: | Jul 11 2009 09:56AM |
| Credit: | This vulnerability was announced by Andrew Griffiths <[email protected]> via Bugtraq on January 26, 2002. |
| Vulnerable: |
Tolis Group BRU 17.0 Linux |
| Not Vulnerable: |
Tolis Group BRU 17.0 .0.2.1 Tolis Group BRU 17.0 .0.0.5 |
Discussion
BRU SetLicense Script Insecure Temporary File Symbolic Link Vulnerability
BRU is a commercially available backup software infrastructure available for both UNIX and Linux Operating Systems. It is distributed and maintained by the Tolis Group.
When BRU executes, it creates temporary files insecurely. BRU uses easily predicted temporary filename /tmp/brutest.$$ where $$ is the process id of the executing shell. The program also does not check for an already existing file of the same name.
This makes it possible for a local user to launch a symbolic link attack, and could lead to the overwriting of system files, or potentially elevated privileges.
BRU is a commercially available backup software infrastructure available for both UNIX and Linux Operating Systems. It is distributed and maintained by the Tolis Group.
When BRU executes, it creates temporary files insecurely. BRU uses easily predicted temporary filename /tmp/brutest.$$ where $$ is the process id of the executing shell. The program also does not check for an already existing file of the same name.
This makes it possible for a local user to launch a symbolic link attack, and could lead to the overwriting of system files, or potentially elevated privileges.
Exploit / POC
BRU SetLicense Script Insecure Temporary File Symbolic Link Vulnerability
This exploit was contributed by Andrew Griffiths <[email protected]>:
This exploit was contributed by Andrew Griffiths <[email protected]>:
References
BRU SetLicense Script Insecure Temporary File Symbolic Link Vulnerability
References:
References:
- Tolis Group Homepage (Tolis Group)