https://cxsecurity.com/issue/WLB-2007110027
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200312-178

FujitsuSiemensNetWorker6.0的nsr_shutdown存在漏洞。本地用户可以借助nsrsh[PID]临时文件上的一个符号链接攻击覆盖任意文件。

product: networker 6.0

date: 19.01.2003

author: l0om  <l0om (at) excluded (dot) org [email concealed]>

possible symlink attack in shutdown scribt

the networker is a backup and storeage system from fujitsu siemens.

the shutdown (nsr_shutdown) scribt from networker version 6.0 contains a

the following:

zero_worklist()

{

[...]

rm -f /tmp/nsrsh$$

echo '. type: nsr group' > /tmp/nsrsh$$  # <----------------

echo 'update work list:; completion:' >> /tmp/nsrsh$$

nsradmin ${RESFILE} -i - < /tmp/nsrsh$$ > /dev/null 2>&1

rm -f /tmp/nsrsh$$

}

[...]

as we all know the "$$" is no protection against symlink attacks

a user could creat a symbolic link from /tmp/nsrsh(guessed pid)

to somewhere in the system and could create or overwrite any file

on the system because it must be executed with root priv.

a better handling would be something like:

TMPFILE=/tmp/nsrsh.$RANDOM.$RANDOM.$RANDOM.$RANDOM.$$

echo '. type: nsr group' > $TMPFILE

echo 'update work list:; completion:' >> $TMPFILE

nsradmin ${RESFILE} -i - < $TMPFILE > /dev/null 2>&1

rm -f $TMPFILE

or "mktemp /tmp/phun.XXXXXX"

- have phun

- l0om

- www.excluded.org

来源:SECTRACK
名称:1008801
链接:http://www.securitytracker.com/id?1008801
来源:BID
名称:9446
链接:http://www.securityfocus.com/bid/9446
来源:BUGTRAQ
名称:20040119Networker6.0-possiblesymlinkattack
链接:http://www.securityfocus.com/archive/1/archive/1/350237/30/21640/threaded
来源:SREASON
名称:3353
链接:http://securityreason.com/securityalert/3353