Vulnerability Note VU#626919

Race condition in periodic

Original Release date: 13 Nov 2000 | Last revised: 28 Mar 2001

Overview

A race condition in the 'periodic' script allows local files to be overwritten. We believe that 'periodic' is typically used only with FreeBSD systems, though it may be installed on other systems.

Description

'periodic' is a script used in conjunction with cron to execute jobs at specified intervals. During ordinary work, periodic creates temporary files with predictable names of the form /tmp/periodic.$PID where $PID is the process identifier of the process running periodic. Because periodic is called by cron it runs with enhanced privileges. By polling the system for an executing instance of periodic, an intruder can exploit a race condition and create a symbolic link from /tmp/periodic.$PID to a file of the intruders choosing. The target file will be overwritten.

Impact

An attacker or intruder who has write access to the local file system and who can discover the PIDs of other processes (both capabilities are typical for ordinary local users) can overwrite any file
on the system regardless of the permissions on the file. This ability can be leveraged to gain root access in many circumstances.

Solution

Apply a patch from your vendor.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
FreeBSDAffected02 Nov 200013 Nov 2000
AppleNot Affected02 Nov 200013 Nov 2000
BSDINot Affected02 Nov 200013 Nov 2000
Compaq Computer CorporationNot Affected02 Nov 200013 Nov 2000
IBMNot Affected02 Nov 200010 Jan 2001
NetBSDNot Affected-02 Nov 2000
OpenBSDNot Affected01 Nov 200013 Nov 2000
CalderaUnknown02 Nov 200013 Nov 2000
Data GeneralUnknown02 Nov 200013 Nov 2000
DebianUnknown02 Nov 200013 Nov 2000
FujitsuUnknown02 Nov 200013 Nov 2000
Hewlett PackardUnknown02 Nov 200013 Nov 2000
NCRUnknown02 Nov 200013 Nov 2000
NECUnknown02 Nov 200013 Nov 2000
RedHatUnknown02 Nov 200013 Nov 2000
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Our thanks to David Lary of SecureWorks for reporting this vulnerability to us and providing technical detail.

This document was written by Shawn Hernan.

Other Information

  • CVE IDs: CAN-2000-0890
  • Date Public: 13 Nov 2000
  • Date First Published: 13 Nov 2000
  • Date Last Updated: 28 Mar 2001
  • Severity Metric: 0.21
  • Document Revision: 14

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.