[UNIX] shtool Insecure Temporary File Creation

From: SecuriTeam (support_at_securiteam.com)
Date: 08/16/05

  • Next message: SecuriTeam: "[UNIX] Open DC hub Buffer Overflow ($RedirectAll)"
    To: list@securiteam.com
    Date: 16 Aug 2005 18:06:11 +0200
    
    

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      shtool Insecure Temporary File Creation
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.gnu.org/software/shtool/> GNU shtool is "a compilation of
    small but very stable and portable shell scripts into a single shell
    tool".

    Shtool contains a security flaw that allows a malicious local user to
    create or overwrite content of arbitrary files with the rights of the user
    using shtool.

    DETAILS

    Vulnerable Systems:
     * Shtool versions 2.0.1 and prior

    The vulnerability is a race condition vulnerability.

    A lot off products use shtool, for example:
    ocan-mysql, SellaNMS, ipcmp, OOPSE, OpenLDAP, PHP, OpenPKG, ..

    Vulnerable code :
    572 # establish a temporary file on request
    573 if [ ".$gen_tmpfile" = .yes ]; then
    574 if [ ".$TMPDIR" != . ]; then
    575 tmpdir="$TMPDIR"
    576 elif [ ".$TEMPDIR" != . ]; then
    577 tmpdir="$TEMPDIR"
    578 else
    579 tmpdir="/tmp"
    580 fi
    581 tmpfile="$tmpdir/.shtool.$$"
    582 rm -f $tmpfile >/dev/null 2>&1
    583 touch $tmpfile
    584 chmod 600 $tmpfile
    585 fi
    ..
    597 # cleanup procedure
    598 shtool_exit () {
    599 rc="$1"
    600 if [ ".$gen_tmpfile" = .yes ]; then
    601 rm -f $tmpfile >/dev/null 2>&1 || true
    602 fi
    603 exit $rc
    604 }

    Workaround:
    Use mktemp, umask and chmod to create secure temporary file.

    Bug report:
     <http://bugs.gentoo.org/show_bug.cgi?id=93782>
    http://bugs.gentoo.org/show_bug.cgi?id=93782

    Disclosure Timeline:
    25.05.05 - Discovered
    25.05.05 - Vendor notified
    25.05.05 - Disclosure

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:eromang@zataz.net> Eric
    Romang.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.


  • Next message: SecuriTeam: "[UNIX] Open DC hub Buffer Overflow ($RedirectAll)"

    Relevant Pages

    • [UNIX] mysqlhotcopy Insecure Temporary File (copy_index)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A vulnerability in mysqlhotcopy allows local attackers to cause the ... Insecure temporary file vulnerability in the mysqlhotcopy script has been ...
      (Securiteam)
    • [UNIX] GIPTables Firewall Race Condition
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... " GIPTables Firewall is a free set of shell ... The vulnerability is caused due to temporary file being created ...
      (Securiteam)
    • [UNIX] apachetop Insecure Temporary File Creation
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The vulnerability is caused due to temporary file being created ... This can be exploited via symlink attacks in combination to ...
      (Securiteam)
    • [UNIX] Trend Micro VirusWall Buffer Overflow in VSAPI Library
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... buffer overflow vulnerability in VSAPI library allows arbitrary code ... is called "vscan" which is set suid root by default. ... permissions and thus granted all local users the privilege to execute the ...
      (Securiteam)
    • [UNIX] SCO Multiple Local Buffer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Local exploitation of a buffer overflow vulnerability in the ppp binary, ... allows attackers to gain root privileges. ...
      (Securiteam)