Bug 23169
| Summary: | exmh follows symlinks when writing to /tmp/exmhErrorMsg | ||
|---|---|---|---|
| Product: | [Retired] Red Hat Linux | Reporter: | Daniel Roesen <dr> |
| Component: | exmh | Assignee: | Crutcher Dunnavant <crutcher> |
| Status: | CLOSED RAWHIDE | QA Contact: | Need Real Name <pelzak> |
| Severity: | medium | Docs Contact: | |
| Priority: | high | ||
| Version: | 7.0 | CC: | jarno.huuskonen |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2001-01-19 02:41:38 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
I tried this on Red Hat 6.x machines also and it produced similar bad behaviour, following symlinks that is. -Stan Bubrouski |
From: "Stanley G. Bubrouski" <stan.EDU> To: BUGTRAQ Subject: Advisory: exmh symlink vulnerability Date: Sun, 31 Dec 2000 15:32:40 -0500 Message-ID: <Pine.GSO.4.21.0012311529370.24743-100000.neu.edu> Author: Stan Bubrouski (stan.edu) Date: December 31, 2000 Package: exmh Versions affected: 2.2 and probably previous versions. Severity: A malicious local user could use a symlink attack to overwrite any file writable by the user executing exmh. Problem: When exmh detects a problem at startup (or possibly other times, I don't have time to investigate) it encounters errors in its code or configuration an error dialog comes up asking the user what happened and giving them the option to fill in an explanation and click a button to send the bug report via e-mail to the maintainer. If the user does attempt to e-mail the maintainer a file named /tmp/exmhErrorMsg is created and if the file exists and is a symlink it will follow the symlink allowing local files to be overwritten depending on the user running exmh. Solution: There are no known solutions at this time. Copyright 2000 Stan Bubrouski -- Stan Bubrouski stan.edu 316 Huntington Ave. Apt #676, Boston, MA 02115 (617) 377-7222