OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: [ Hackerslab bug_paper ] HP-UX crontab temporary file symboliclink vulnerability
From: Casper Dik (Casper.DikHOLLAND.SUN.COM)
Date: Thu Oct 26 2000 - 05:37:53 CDT

>Tested also on:
>
>FreeBSD 3.3 = Vulnerable
>FreeBSD 2.2.8 = Vulnerable
>Aix 4.2 = Not Vulnerable
>Linux Slackware 7.0 = Not Vulnerable
>Linux Slackware 4.0 = Not Vulnerable

Solaris: not vulnerable (probably since 2.4).

6210: seteuid(10000) = 0
6210: open64("/tmp/crontabWCaqim", O_RDONLY) = 5
6210: seteuid(0) = 0

Root owned file:

6225: open64("/tmp/crontab9qaakm", O_RDONLY) Err#13 EACCES
6225: unlink("/tmp/crontab9qaakm") Err#1 EPERM

This was changed in may '94 in response to bug 1160749.

Not sure if there are patches for really old releases
(101572-03 for 2.3 appears to cover this)

Casper