OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: [Full-Disclosure] Possible race condition in Symantec AntiVirus Scan Engine for Red Hat Linux during LiveUpdate

Valdis.Kletnieksvt.edu
Date: Mon Feb 16 2004 - 10:21:39 CST


On Mon, 16 Feb 2004 16:49:53 +0100, "Dr. Peter Bieringer" said:

> logfile=/tmp/LiveUpdate.log <---!!!!!!
>
> Impact:
> Before first run of LiveUpdate (like suggested in doc, user "symantec" does
> this) a possible race condition via a symlink attack by another user will
> result in the creation of a new file (as user "symantec") or appending
> LiveUpdate log to an existent file (owned by user "symantec").

For bonus points, figure out what happens if you reboot and your /etc/fstab has this:

none /tmp tmpfs mode=1777 0 0

The gift that keeps on giving. ;)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFAMO4TcC3lWbTT17ARArQFAJ9nPyvuisTKJQZJz9wZCFmzRFIvvgCgs7yW
ofaPmjFeOFlxFZcxUus75bA=
=dB3Z
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html