CERT/CC Vulnerability Note VU#10277

Overview

sh uses /tmp files of a predictable name in creating files for input redirection using the << operator.

Description

When performing the "<<" redirection, /bin/sh creates a temporary file in /tmp with a name based on the process id, writes subsequent input out to that file, and then closes the file before re-opening it as the standard input of the command to be executed. At no stage are the results of the creat(), write(), or open() calls checked for an error status.

Impact

It is possible for another user to alter what is read from this file.

If the sticky bit is not set on /tmp, the file can be simply removed, and a new file created in its place
If the sticky bit is set, then it is possible to guess what the file will be called and create it before /bin/sh does (the creat() call performed by the shell does not result in an open() call with O_EXCL set) and hence it is possible to maintain a handle on the underlying file.
If a fifo is created in place of the temporary file it is particularly easy to insert an extra command into the input transparently, and without having to worry about ensuring the bug is exploited during the narrow window of time in which it occurs.

Even without reading, creating this file may block the execution of commands using the << operator.
It may also be possible to create a symbolic link named as the temporary file and pointed to any other file on the system writable by the user of the shell, which may lead to corruption of the file to which the link is pointed.

Solution

Apply vendor patches; see the Systems Affected section below.

Avoid the use of << operator in cron jobs and similar administration scripts.

Vendor Information

10277

Filter by status:

Filter by content: Additional information available

Sort by:

Expand all

Apple Computer, Inc. Affected

Compaq Computer Corporation Affected

Notified: May 14, 2001 Updated: June 13, 2003

Status

Affected

Vendor Statement

TITLE: Tru64 UNIX Potential Security Vulnerability, Privileged App. Core Files and Temp File/Symbolic Links With Temp Files (SSRT1-41U, SSRT0742U, SSRT0759U)
NOTICE: There are no restrictions for distribution of this advisory provided that it remains complete and intact.
RELEASE DATE: 28 JANUARY 2002
SOURCE: Compaq Computer Corporation Compaq Services Software Security Response Team
CROSS REFERENCE: (CVE CAN-2000-1134, CERT/CC VU#10277)
PROBLEM SUMMARY:
(1). (SSRT1-41U) It has been reported to Compaq that Tru64 UNIX has a potential security vulnerability with it's utilization of temporary files in the shell programs and system startup or management scripts.
Because the potential security vulnerability can only be exploited by users who have access to your local security domain, the risk is diminished. Many systems operate in a "turn key" mode where login access exists only for system administration. These systems are not at risk. Examples of these systems are file servers and web servers.
There are things that can be done to reduce the potential vulnerability and exposure. A set of Compaq guidelines are available from the Compaq Services web page at:
http://www.support.compaq.com/sec/system-protections-tru64.html
(2). (SSRT0742U, SSRT0759U) A potential security vulnerability has been reported, where under certain circumstances, system integrity may be compromised. This may be in the form of improper privileged application core file access.

VERSIONS IMPACTED:
All supported versions as well as recent prior versions. The affected versions include but are not limited to Tru64 UNIX versions V5.1a, V5.1, V5.0a, V5.0, V4.0g, V4.0f and V4.0d.
RESOLUTION:
Early Release Patches (ERPs) are available for all supported versions of Tru64 UNIX Tru64 UNIX 4.0F, 4.0G, 5.0A, 5.1 and 5.1A and as a courtesy, for V4.0D and V4.0F as support for these two have just recently ended.

To obtain a the patch or patches needed, connect to the FTP siteftp://ftp.support.compaq.com/public/unix/choose the version directory required and download the appropriate patch.

--------------------- Early Release Patches ---------------------
Until the Tru64 UNIX fixes are generally available in mainstream patch kits, Compaq recommends use of the following Early Release Patches(ERP) kits:
Tru64 UNIX 4.0D Prerequisite: 4.0D with Patch Kit 9 (BL17) installed ERP Kit Name: DUV40DB17-C0061401-12858-E-20020115.tar Kit Location: http://ftp1.support.compaq.com/public/unix/v4.0d/
Tru64 UNIX 4.0F: Prerequisite: 4.0F with Patch Kit 6 (BL17) installed ERP Kit Name: DUV40FB17-C0061801-12860-E-20020115.tar Kit Location: http://ftp1.support.compaq.com/public/unix/v4.0f/
Prerequisite: 4.0F with Patch Kit 7 (BL18) installed ERP Kit Name: DUV40FB18-C0065000-12930-E-20020122.tar Kit Location: http://ftp1.support.compaq.com/public/unix/v4.0f/
Tru64 UNIX 4.0G: Prerequisite: 4.0G with Patch Kit 3 (BL17) installed ERP Kit Name: T64V40GB17-C0009303-12856-E-20020115.tar Kit Location: http://ftp1.support.compaq.com/public/unix/v4.0g/
Tru64 UNIX 5.0: Prerequisite: 5.0 with Patch Kit 4 (BL17) installed ERP Kit Name: T64V50B17-C0006900-12861-E-20020115.tar Kit Location: http://ftp1.support.compaq.com/public/unix/v5.0/
Tru64 UNIX 5.0A: Prerequisite: 5.0A with Patch Kit 3 (BL17) installed ERP Kit Name: T64V50AB17-C0017601-12862-E-20020115.tar Kit Location: http://ftp1.support.compaq.com/public/unix/v5.0a/
Tru64 UNIX 5.1: Prerequisite: 5.1 with Patch Kit 3 (BL17) installed ERP Kit Name: T64V51B17-C0095501-12931-E-20020122.tar Kit Location: http://ftp1.support.compaq.com/public/unix/v5.1/
Prerequisite: 5.1 with Patch Kit 4 (BL18) installed ERP Kit Name: T64V51B18-C0094800-12864-E-20020115.tar Kit Location: http://ftp1.support.compaq.com/public/unix/v5.1/
Tru64 UNIX 5.1A: Prerequisite: 5.1A with Patch Kit 1 (BL1) installed ERP Kit Name: T64V51AB1-C0008900-12954-E-20020124.tar Kit Location: http://ftp1.support.compaq.com/public/unix/v5.1a/
MD5 and SHA1 checksums are available in the public patch notice for the ERP kits. You can find information on how to verify MD5 and SHA1 checksums at:http://www.support.compaq.com/patches/whats-new.shtml

The fixes contained in the early release patch (ERP) kits will be available in the next aggregate patch kits for each supported product release as follows: - Tru64 UNIX 4.0F PK8 - Tru64 UNIX 4.0G PK4 - Tru64 UNIX 5.0A PK4 - Tru64 UNIX 5.1 PK5 - Tru64 UNIX 5.1A PK2
NOTE: (1) Please review the README file(s) for each patch prior to installation.
After completing the update, Compaq strongly recommends that you perform an immediate backup of your system disk so that any subsequent restore operations begin with updated software. Otherwise, you must reapply the update after a future restore operation. Also, if at some future time you upgrade your system to a later patch version, you may need to reapply the appropriate update.
SUPPORT:
For further information, please contact your normal Compaq Global Services support channel.
SUBSCRIBE:
To subscribe to automatically receive future Security Advisories from the Compaq's Software Security Response Team via electronic mail:http://www.support.compaq.com/patches/mailing-list.shtml
REPORT:
To report a potential security vulnerability with any Compaq supported product, send email to: security-ssrt@compaq.com

Compaq appreciates your cooperation and patience. We regret any inconvenience applying this information may cause. As always, Compaq urges you to periodically review your system management and security procedures. Compaq will continue to review and enhance the security features of its products and work with customers to maintain and improve the security and integrity of their systems.
"Compaq is broadly distributing this Security Advisory to notify all users of Compaq products of the important security information contained in this Advisory. Compaq recommends that all users determine the applicability of this information to their individual situations and take appropriate action. Compaq does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, Compaq will not be responsible for any damages resulting from user's use or disregard of the information provided in this Advisory."
Copyright 2002 Compaq Computer Corporation. All rights reserved.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The above statement was made by Compaq Computer Corporation prior to their merger with Hewlett packard.

For additional information, please see

http://ftp.support.compaq.com/patches/public/unix/v4.0f/duv40fb18-c0065000-12930-e-20020122.README

Please see:
http://www.tru64unix.compaq.com/unix/security-download.html for the patch/security information;
http://ftp.support.compaq.com/patches/.new/unix.shtml for the actual patches.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

DEC Affected

Notified: May 14, 2001 Updated: January 30, 2002

Status

Affected

Vendor Statement

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

If you have feedback, comments, or additional information about this vulnerability, please send email to Compaq Computer Corporation.

Please see:
http://www.tru64unix.compaq.com/unix/security-download.html for the patch/security information;
http://ftp.support.compaq.com/patches/.new/unix.shtml for the actual patches.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

FreeBSD, Inc. Affected

Hewlett-Packard Company Affected

IBM Corporation Affected

Mandriva, Inc. Affected

SGI Affected

Sun Microsystems, Inc. Affected

The SCO Group (SCO Linux) Affected

The SCO Group (SCO Unix) Affected

Berkeley Software Design, Inc. Not Affected

OpenBSD Not Affected

Data General Unknown

Debian Linux Unknown

Fujitsu Unknown

NEC Corporation Unknown

NeXT Unknown

NetBSD Unknown

Red Hat, Inc. Unknown

Sequent Computer Systems, Inc. Unknown

Siemens Nixdorf Unknown

Sony Corporation Unknown

Unisys Unknown

View all 24 vendors View less vendors

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

Acknowledgements

The original discoverer of this vul was Gordon Irlam of the Univeristy of Adelaide, Australia.

This document was written by James T. Ellis, modified by Tim Shimeall to reflect 2001 reporting

Other Information

CVE IDs:	CVE-2000-1134
Severity Metric:	1.73
Date Public:	1991-07-17
Date First Published:	2001-07-02
Date Last Updated:	2007-04-24 18:02 UTC
Document Revision:	19

Software Engineering Institute

CERT Coordination Center

Various shells create temporary files insecurely when using << operator

Vulnerability Note VU#10277

Overview

Description

Impact

Solution

Vendor Information

Apple Computer, Inc. Affected

Compaq Computer Corporation Affected

DEC Affected

FreeBSD, Inc. Affected

Hewlett-Packard Company Affected

IBM Corporation Affected

Mandriva, Inc. Affected

SGI Affected

Sun Microsystems, Inc. Affected

The SCO Group (SCO Linux) Affected

The SCO Group (SCO Unix) Affected

Berkeley Software Design, Inc. Not Affected

OpenBSD Not Affected

Data General Unknown

Debian Linux Unknown

Fujitsu Unknown

NEC Corporation Unknown

NeXT Unknown

NetBSD Unknown

Red Hat, Inc. Unknown

Sequent Computer Systems, Inc. Unknown

Siemens Nixdorf Unknown

Sony Corporation Unknown

Unisys Unknown

CVSS Metrics

References

Acknowledgements

Other Information

Contact CERT/CC