| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 21 Oct 2011 19:59:59 -0400 (EDT)
From: bugs@....dhs.org
To: full-disclosure@...ts.grok.org.uk
Subject: Symlink vulnerabilities
After seeing an advisory for symlink attacks in ubuntu and opensuse:
http://people.canonical.com/~ubuntu-security/cve/2009/CVE-2009-1297.html
Which I thought people really didn't care too much about anymore, I took a
quick look at one of my ubuntu 8.04lts boxes:
/sbin/iscsi_discovery: df=/tmp/discovered.$$ <-- iscsi tmp vuln mentioned
above.
/usr/sbin/grub-install:log_file=/tmp/grub-install.log.$$
/usr/sbin/grub-install:img_file=/tmp/grub-install.img.$$
/usr/sbin/mkboot: b=$tmpdir/boot$$
/usr/sbin/MAKEFLOPPIES:TMPDEVICE=/dev/tmpfloppy$$
This is just what I saw in /sbin.
These are so easy to fix/avoid, I don't know why developers are still
introducing them to their code.
Here are some for netbackup:
/usr/openv/netbackup/bin/nblu_registration:TMPFILE=/tmp/nblureg.$$
/usr/openv/netbackup/bin/bp.kill_all: rm -f ${TMPDIR}/results.$$
/usr/openv/netbackup/bin/bp.kill_all: rm -f ${TMPDIR}/nb_daemons.$$
/usr/openv/netbackup/bin/bp.kill_all: rm -f ${TMPDIR}/nb_daemons.$$
bzexe utility:
/bin/bzexe:tmp=gz$$
/bin/bzexe:rm -f zfoo[12]$$
lorder utility:
/usr/bin/lorder:TDIR=/tmp/_lorder$$
bashbug:
/usr/bin/bashbug:TEMPDIR=$TMPDIR/bbug.$$
Maybe I should use bashbug to report a bug in bashbug?
http://www.downspout.org/?q=node/6
-- Larry Cashdollar
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists