Overview
A race condition in the 'periodic' script allows local files to be overwritten. We believe that 'periodic' is typically used only with FreeBSD systems, though it may be installed on other systems.
Description
'periodic' is a script used in conjunction with cron to execute jobs at specified intervals. During ordinary work, periodic creates temporary files with predictable names of the form /tmp/periodic.$PID where $PID is the process identifier of the process running periodic. Because periodic is called by cron it runs with enhanced privileges. By polling the system for an executing instance of periodic, an intruder can exploit a race condition and create a symbolic link from /tmp/periodic.$PID to a file of the intruders choosing. The target file will be overwritten. |
Impact
An attacker or intruder who has write access to the local file system and who can discover the PIDs of other processes (both capabilities are typical for ordinary local users) can overwrite any file |
Solution
Apply a patch from your vendor. |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
Our thanks to David Lary of SecureWorks for reporting this vulnerability to us and providing technical detail.
This document was written by Shawn Hernan.
Other Information
| CVE IDs: | CVE-2000-0890 |
| Severity Metric: | 0.21 |
| Date Public: | 2000-11-13 |
| Date First Published: | 2000-11-13 |
| Date Last Updated: | 2001-03-28 04:25 UTC |
| Document Revision: | 14 |