Cray Inc. Information for VU#336083
Uudecode performs inadequate checks on user-specified output files
- Vendor Information Help Date Notified: 15 Jul 2002
- Statement Date:
- Date Updated: 19 Aug 2002
Cray, Inc. is vulnerable however it is by design and will remain that way to maintain POSIX compliancy. According to the POSIX standards for uudecode:
"If the pathname of the file to be produced exists, and the user does not have write permission on the file, uudecode will terminate with an error. If the pathname of the file to be produced exists, and the user has write permission on that file, the existing file will be overwritten."
So, if a user has root write permission then yes they can overwrite a file using uudecode (or cat, or other various unix commands).
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.