FreeBSD gdc Symlink Vulnerability
BID:835
Info
FreeBSD gdc Symlink Vulnerability
| Bugtraq ID: | 835 |
| Class: | Origin Validation Error |
| CVE: |
CVE-1999-0857 |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 01 1999 12:00AM |
| Updated: | Jul 11 2009 12:56AM |
| Credit: | First posted to BugTraq by Brock Tellier <[email protected]> on December 1, 1999. |
| Vulnerable: |
FreeBSD FreeBSD 3.3 |
| Not Vulnerable: | |
Discussion
FreeBSD gdc Symlink Vulnerability
It is possible to write debug ouput from gdc to a file (/var/tmp/gdb_dump). Unfortunately, gdc follows symbolic links which can be created in tmp and will overwrite any file on the system thanks to it being setiud root. This does not cause any immediate compromises and is more of a denial of service attack since it does not change the permissions of the overwritten files (to say, world writeable or group writeable). Local users are required to be in group wheel (or equivelent) to execute gdc.
It is possible to write debug ouput from gdc to a file (/var/tmp/gdb_dump). Unfortunately, gdc follows symbolic links which can be created in tmp and will overwrite any file on the system thanks to it being setiud root. This does not cause any immediate compromises and is more of a denial of service attack since it does not change the permissions of the overwritten files (to say, world writeable or group writeable). Local users are required to be in group wheel (or equivelent) to execute gdc.
Exploit / POC
FreeBSD gdc Symlink Vulnerability
ln -s /etc/master.passwd /var/tmp/gated_dump
And then wait for a priviliged user to run gdc dump.
ln -s /etc/master.passwd /var/tmp/gated_dump
And then wait for a priviliged user to run gdc dump.
Solution / Fix
FreeBSD gdc Symlink Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
FreeBSD gdc Symlink Vulnerability
References:
References: