Vulnerability Note VU#10277

Various shells create temporary files insecurely when using << operator

Original Release date: 02 Jul 2001 | Last revised: 24 Apr 2007

Overview

sh uses /tmp files of a predictable name in creating files for input redirection using the << operator.

Description

When performing the "<<" redirection, /bin/sh creates a temporary file in /tmp with a name based on the process id, writes subsequent input out to that file, and then closes the file before re-opening it as the standard input of the command to be executed. At no stage are the results of the creat(), write(), or open() calls checked for an error status.

Impact

It is possible for another user to alter what is read from this file.

  • If the sticky bit is not set on /tmp, the file can be simply removed, and a new file created in its place
  • If the sticky bit is set, then it is possible to guess what the file will be called and create it before /bin/sh does (the creat() call performed by the shell does not result in an open() call with O_EXCL set) and hence it is possible to maintain a handle on the underlying file.
  • If a fifo is created in place of the temporary file it is particularly easy to insert an extra command into the input transparently, and without having to worry about ensuring the bug is exploited during the narrow window of time in which it occurs.
Even without reading, creating this file may block the execution of commands using the << operator.
It may also be possible to create a symbolic link named as the temporary file and pointed to any other file on the system writable by the user of the shell, which may lead to corruption of the file to which the link is pointed.

Solution

Apply vendor patches; see the Systems Affected section below.

Avoid the use of << operator in cron jobs and similar administration scripts.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Apple Computer, Inc.Affected14 May 200125 Sep 2001
Compaq Computer CorporationAffected14 May 200113 Jun 2003
DECAffected14 May 200130 Jan 2002
FreeBSD, Inc.Affected20 Nov 200015 May 2001
Hewlett-Packard CompanyAffected14 May 200113 Jun 2003
IBM CorporationAffected14 May 200113 Jun 2001
Mandriva, Inc.Affected20 Nov 200016 Jul 2001
SGIAffected14 May 200129 Jan 2002
Sun Microsystems, Inc.Affected17 Jul 199117 May 2001
The SCO Group (SCO Linux)Affected14 May 200119 Jun 2001
The SCO Group (SCO Unix)Affected14 May 200129 Jan 2002
Berkeley Software Design, Inc.Not Affected14 May 200115 May 2001
OpenBSDNot Affected30 Oct 200005 Jul 2001
Data GeneralUnknown14 May 200111 Jun 2001
Debian LinuxUnknown14 May 200111 Jun 2001
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

The original discoverer of this vul was Gordon Irlam of the Univeristy of Adelaide, Australia.

This document was written by James T. Ellis, modified by Tim Shimeall to reflect 2001 reporting

Other Information

  • CVE IDs: CVE-2000-1134
  • Date Public: 17 Jul 91
  • Date First Published: 02 Jul 2001
  • Date Last Updated: 24 Apr 2007
  • Severity Metric: 1.73
  • Document Revision: 19

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.