[Full-disclosure] Symlink vulnerabilities

[bugs@xxxxxxxxxxx]

After seeing an advisory for symlink attacks in ubuntu and opensuse:

http://people.canonical.com/~ubuntu-security/cve/2009/CVE-2009-1297.html

Which I thought people really didn't care too much about anymore, I took a
quick look at one of my ubuntu 8.04lts boxes:

/sbin/iscsi_discovery: df=/tmp/discovered.$$ <-- iscsi tmp vuln mentioned
above.
/usr/sbin/grub-install:log_file=/tmp/grub-install.log.$$
/usr/sbin/grub-install:img_file=/tmp/grub-install.img.$$
/usr/sbin/mkboot: b=$tmpdir/boot$$
/usr/sbin/MAKEFLOPPIES:TMPDEVICE=/dev/tmpfloppy$$

This is just what I saw in /sbin.

These are so easy to fix/avoid, I don't know why developers are still
introducing them to their code.

Here are some for netbackup:

/usr/openv/netbackup/bin/nblu_registration:TMPFILE=/tmp/nblureg.$$
/usr/openv/netbackup/bin/bp.kill_all: rm -f ${TMPDIR}/results.$$
/usr/openv/netbackup/bin/bp.kill_all: rm -f ${TMPDIR}/nb_daemons.$$
/usr/openv/netbackup/bin/bp.kill_all: rm -f ${TMPDIR}/nb_daemons.$$

bzexe utility:

/bin/bzexe:tmp=gz$$
/bin/bzexe:rm -f zfoo[12]$$

lorder utility:

/usr/bin/lorder:TDIR=/tmp/_lorder$$

bashbug:

/usr/bin/bashbug:TEMPDIR=$TMPDIR/bbug.$$

Maybe I should use bashbug to report a bug in bashbug?

http://www.downspout.org/?q=node/6

-- Larry Cashdollar


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/