Vulnerability Note VU#579928

diffutils sdiff creates temporary files insecurely

Overview

diffutils, a set of utilities distributed with many versions of linux, contains a utility called sdiff, which creates temporary files of predictable names in an insecure fashion. Using a symbolic link attack, an intruder can cause overwrite of any file writable by the user executing sdiff.

I. Description

sdiff creates temporary files as part of the file comparison process. Under some conditions, sdiff will create files in /tmp with predictable names, and furthermore does not check for prior existence or ownership of these files.

II. Impact

By creating a series of symbolic links, an intruder can cause sdiff to overwrite any file writable by the user executing sdiff, which may corrupt data or deny service.

III. Solution

Apply vendor patches; see the Systems Affected section below.

Systems Affected

Vendor	Status	Date Updated
Caldera	Vulnerable	19-Sep-2001
Debian	Unknown	9-Oct-2001
Immunix	Vulnerable	17-Sep-2001
MandrakeSoft	Vulnerable	17-Sep-2001
RedHat	Vulnerable	8-Nov-2001
Sequent	Unknown	9-Oct-2001
Trustix	Vulnerable	18-Sep-2001

References

http://www.securityfocus.com/bid/2191
http://www.linux-mandrake.com/en/updates/2001/MDKSA-2001-008.php3?dis=6.1
http://www.linuxsecurity.com/advisories/other_advisory-1034.html
http://www.linuxsecurity.com/advisories/other_advisory-1047.html
http://www.redhat.com/support/errata/RHSA-2001-116.html

Credit

This vulnerability was first described by Greg Kroah-Hartman of Immunix.

This document was last modified by Tim Shimeall.

Other Information

Date Public	01/10/2001
Date First Published	10/09/2001 11:15:19 AM
Date Last Updated	11/08/2001
CERT Advisory
CVE Name	CAN-2001-0117
Metric	4.50
Document Revision	15

If you have feedback, comments, or additional information about this vulnerability, please send us email.