[Full-disclosure] Symlink vulnerabilities

After seeing an advisory for symlink attacks in ubuntu and opensuse:


Which I thought people really didn't care too much about anymore, I took a
quick look at one of my ubuntu 8.04lts boxes:

/sbin/iscsi_discovery: df=/tmp/discovered.$$ <-- iscsi tmp vuln mentioned
/usr/sbin/mkboot: b=$tmpdir/boot$$

This is just what I saw in /sbin.

These are so easy to fix/avoid, I don't know why developers are still
introducing them to their code.

Here are some for netbackup:

/usr/openv/netbackup/bin/bp.kill_all: rm -f ${TMPDIR}/results.$$
/usr/openv/netbackup/bin/bp.kill_all: rm -f ${TMPDIR}/nb_daemons.$$
/usr/openv/netbackup/bin/bp.kill_all: rm -f ${TMPDIR}/nb_daemons.$$

bzexe utility:

/bin/bzexe:rm -f zfoo[12]$$

lorder utility:




Maybe I should use bashbug to report a bug in bashbug?


-- Larry Cashdollar

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/