GNU make /tmp Vulnerability
BID:981
Info
GNU make /tmp Vulnerability
| Bugtraq ID: | 981 |
| Class: | Race Condition Error |
| CVE: |
CVE-2000-0151 |
| Remote: | No |
| Local: | Yes |
| Published: | Feb 09 2000 12:00AM |
| Updated: | Jul 11 2009 01:56AM |
| Credit: | This vulnerability was posted to the Bugtraq mailing list on February 9, 2000 in a SuSE Linux advisory. |
| Vulnerable: |
Turbolinux Turbolinux 6.0.2 Turbolinux Turbolinux 4.4 Turbolinux Turbolinux 4.2 SuSE Linux 6.3 SuSE Linux 6.1 GNU make 3.77 -44 Debian Linux 2.1 |
| Not Vulnerable: | |
Discussion
GNU make /tmp Vulnerability
A vulnerability exists in the way GNU make handles being fed Makefile contents via standard in. GNU make will create file in /tmp, without checking to see if they already exist, or it they are in fact symbolic links. A would be attacker could simply create an appropriately named symbolic link, and point it elsewhere on the file system. In turn, they could create files owned by the user running make. If this user is root, it would be possible to obtain root privilege.
A vulnerability exists in the way GNU make handles being fed Makefile contents via standard in. GNU make will create file in /tmp, without checking to see if they already exist, or it they are in fact symbolic links. A would be attacker could simply create an appropriately named symbolic link, and point it elsewhere on the file system. In turn, they could create files owned by the user running make. If this user is root, it would be possible to obtain root privilege.
Exploit / POC
GNU make /tmp Vulnerability
x
x
References
GNU make /tmp Vulnerability
References:
References:
- S.u.S.E. Homepage (S.u.S.E.)
- S.u.S.E. Patches/Fixes (S.u.S.E.)