Multiple Vendor BSD make /tmp Race Condition Vulnerability
BID:939
Info
Multiple Vendor BSD make /tmp Race Condition Vulnerability
| Bugtraq ID: | 939 |
| Class: | Race Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 19 2000 12:00AM |
| Updated: | Jan 19 2000 12:00AM |
| Credit: | First exposed in a FreeBSD Security Advisory, published on January 19, 2000. |
| Vulnerable: |
OpenBSD OpenBSD 2.6 NetBSD NetBSD 1.4.1 x86 FreeBSD FreeBSD 3.4 |
| Not Vulnerable: | |
Discussion
Multiple Vendor BSD make /tmp Race Condition Vulnerability
There is an exploitable race condition in BSD derived versions of make. The problem lies in the way that make communicates with its children processes when passed the -j parameter. "make" does so by writing shell commands to temporary files in /tmp, which the children process read (and then execute..). In the process of doing this, "make" creates and resuses temporary files several times with known filenames. If the file name being used were to be observed by an attacker, it is possible to write arbitrary commands to these files immediately after legitimate ones, then have them executed by the child processes if the race is won.
There is an exploitable race condition in BSD derived versions of make. The problem lies in the way that make communicates with its children processes when passed the -j parameter. "make" does so by writing shell commands to temporary files in /tmp, which the children process read (and then execute..). In the process of doing this, "make" creates and resuses temporary files several times with known filenames. If the file name being used were to be observed by an attacker, it is possible to write arbitrary commands to these files immediately after legitimate ones, then have them executed by the child processes if the race is won.
Exploit / POC
Multiple Vendor BSD make /tmp Race Condition Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].