full-disclosure - Java Virtual Machine Symlink Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <34663.66.58.158.195.1055016959.squirrel@www.nothotmail.org>
From: meme-boi at nothotmail.org (meme-boi)
Subject: Java Virtual Machine Symlink Vulnerability

SynopsisTitle: 	Java Virtual Machine Symlink Vulnerability
Platforms: 	Linux Distributions with j2re1.4.1_02
Discovered:	Today
Local:		Yes.
Remote:		No.

1. Overview

Java Virtual Machine stores temporary log files within the /tmp directory
with a prefix of jpsock.**_* etc in an insecure manner.

2. Background

The Java virtual machine is the cornerstone of the Java and Java 2
platforms. It is the component of the technology responsible for its
hardware- and operating system- independence, the small size of its
compiled code, and its ability to protect users from malicious programs.
3. Issue

Java Virtual Machin creates the file "/tmp/jpsock.**_*" on startup. The
existance and owner of the file is not checked prior to writing startup
information to the file.

4. Impact

Local users may create a symlink from an arbitrary file to /tmp/jpsock.**_*.
When JVM is executed, the file pointed to by the symlink will be overwritten.

This can and will be used to gain elevated privileges via symlink attack

5. Recommendation

You shouldn't be using it anyways. See my prior post

6. Vendor Notification

None - this is full disclosure

Summer of the Sickness is drawing near.......

Copyright ? 2003, Paper Street Soap Company, Inc.