Eric Raymond cstrings tempnam() Insecure Temporary File Creation Vulnerability
BID:9391
Info
Eric Raymond cstrings tempnam() Insecure Temporary File Creation Vulnerability
| Bugtraq ID: | 9391 |
| Class: | Race Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 29 2003 12:00AM |
| Updated: | Dec 29 2003 12:00AM |
| Credit: | This issue was discovered by the vendor. |
| Vulnerable: |
Eric Raymond cstrings 2.2 |
| Not Vulnerable: |
Eric Raymond cstrings 2.3 |
Discussion
Eric Raymond cstrings tempnam() Insecure Temporary File Creation Vulnerability
cstrings creates temporary files in an insecure manner using the tempnam() function, potentially creating an exploitable race condition that could be leveraged by a malicious local user.
An attacker could leverage this issue by creating a malicious symbolic link (using the name of the anticipated temporary file) that points to another file that is owned by the user who is expected to run with software. When the software is run, it may perform operations on the file pointed to by the symbolic link instead of the legitimate output file. This could theoretically lead to file corruption, most likely resulting in destruction of data and denial of service.
cstrings creates temporary files in an insecure manner using the tempnam() function, potentially creating an exploitable race condition that could be leveraged by a malicious local user.
An attacker could leverage this issue by creating a malicious symbolic link (using the name of the anticipated temporary file) that points to another file that is owned by the user who is expected to run with software. When the software is run, it may perform operations on the file pointed to by the symbolic link instead of the legitimate output file. This could theoretically lead to file corruption, most likely resulting in destruction of data and denial of service.
Exploit / POC
Eric Raymond cstrings tempnam() Insecure Temporary File Creation Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Eric Raymond cstrings tempnam() Insecure Temporary File Creation Vulnerability
Solution:
This issue has been addressed in cstrings 2.3.
Eric Raymond cstrings 2.2
Solution:
This issue has been addressed in cstrings 2.3.
Eric Raymond cstrings 2.2
-
Eric Raymond cstrings-2.3.tar.gz
http://www.catb.org/~esr/cstrings/cstrings-2.3.tar.gz
References
Eric Raymond cstrings tempnam() Insecure Temporary File Creation Vulnerability
References:
References:
- cstrings Changelog (Eric S. Raymond)
- cstrings Homepage (Eric S. Raymond)