CVSup-Mirror Insecure Temporary Files Vulnerability
BID:6150
Info
CVSup-Mirror Insecure Temporary Files Vulnerability
| Bugtraq ID: | 6150 |
| Class: | Configuration Error |
| CVE: |
CVE-2003-0606 |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 09 2002 12:00AM |
| Updated: | Jul 12 2009 05:56PM |
| Credit: | Discovery of this issue is credited to Joshua Goodall <[email protected]>. |
| Vulnerable: |
sup sup 1.8 CVSup cvsup-mirror 1.2 |
| Not Vulnerable: | |
Discussion
CVSup-Mirror Insecure Temporary Files Vulnerability
cvsup-mirror is prone to a vulnerability which may enable local attackers to corrupt critical system files.
cvsup-mirror creates a file entitled 'cvsupd.out' in the /var/tmp/ directory. A local attacker could create a symbolic link in /var/tmp with the same name, pointing to critical system files.
Any actions performed by cvsup-mirror on 'cvsupd.out' will instead be performed on files pointed to by the symbolic link. This may result in a denial of service if critical files are overwritten, and may potentially allow for privilege escalation.
cvsup-mirror is prone to a vulnerability which may enable local attackers to corrupt critical system files.
cvsup-mirror creates a file entitled 'cvsupd.out' in the /var/tmp/ directory. A local attacker could create a symbolic link in /var/tmp with the same name, pointing to critical system files.
Any actions performed by cvsup-mirror on 'cvsupd.out' will instead be performed on files pointed to by the symbolic link. This may result in a denial of service if critical files are overwritten, and may potentially allow for privilege escalation.
Exploit / POC
CVSup-Mirror Insecure Temporary Files Vulnerability
There is no exploit code required.
There is no exploit code required.
Solution / Fix
CVSup-Mirror Insecure Temporary Files Vulnerability
Solution:
Debian has released fixes for this issue. See referenced advisory for additional details.
sup sup 1.8
Solution:
Debian has released fixes for this issue. See referenced advisory for additional details.
sup sup 1.8
-
Debian sup_1.8-8woody1_alpha.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/s/sup/sup_1.8-8woody1_alp ha.deb -
Debian sup_1.8-8woody1_arm.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/s/sup/sup_1.8-8woody1_arm .deb -
Debian sup_1.8-8woody1_hppa.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/s/sup/sup_1.8-8woody1_hpp a.deb -
Debian sup_1.8-8woody1_i386.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/s/sup/sup_1.8-8woody1_i38 6.deb -
Debian sup_1.8-8woody1_ia64.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/s/sup/sup_1.8-8woody1_ia6 4.deb -
Debian sup_1.8-8woody1_m68k.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/s/sup/sup_1.8-8woody1_m68 k.deb -
Debian sup_1.8-8woody1_mips.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/s/sup/sup_1.8-8woody1_mip s.deb -
Debian sup_1.8-8woody1_mipsel.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/s/sup/sup_1.8-8woody1_mip sel.deb -
Debian sup_1.8-8woody1_powerpc.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/s/sup/sup_1.8-8woody1_pow erpc.deb -
Debian sup_1.8-8woody1_s390.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/s/sup/sup_1.8-8woody1_s39 0.deb -
Debian sup_1.8-8woody1_sparc.deb
Debian GNU/Linux 3.0 (woody)
http://security.debian.org/pool/updates/main/s/sup/sup_1.8-8woody1_spa rc.deb
References
CVSup-Mirror Insecure Temporary Files Vulnerability
References:
References:
- Security issue in net/cvsup-mirror port (Joshua Goodall
)