CVE-2011-1920: Low severity netbsd current vulnerability
A Debian bug report [1] noted that pmake (and mk-files in Fedora) contained the files /usr/share/mk/bsd.{lib,prog}.mk that created temporary files insecurely with predictable file names in /tmp (/tmp/depend[PID]), ignoring any $TMPDIR values.
In lib.mk:
446 afterdepend: .depend 447 @(TMP=/tmp/depend$$$$; \ 448 sed -e 's/^\([^\.]\).o[ ]:/\1.o \1.po \1.so \1.ln:/' \ 449 < .depend > $$TMP; \ 450 mv $$TMP .depend) 451 .endif
The same is found in prog.mk (in Fedora's mk-files package).
The Debian bug report proposes to use mktemp here:
- @(TMP=/tmp/depend$$$$; \ + @(TMP=mktemp -t dependXXXXXXXXXX || exit $$?; \
Upstream has already corrected this by removing the offending code [2],[3].
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=626673 [2] http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.lib.mk.diff?r1=1.239&r2=1.240 [3] http://cvsweb.netbsd.org/bsdweb.cgi/src/share/mk/bsd.prog.mk.diff?r1=1.192&r2=1.193
Other sources
The make include files in NetBSD before 1.6.2, as used in pmake 1.111 and other products, allow local users to overwrite arbitrary files via a symlink attack on a /tmp/depend##### temporary file, related to (1) bsd.lib.mk and (2) bsd.prog.mk.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1920?
CVE-2011-1920 is classified as a medium severity vulnerability.
How do I fix CVE-2011-1920?
To fix CVE-2011-1920, update the affected software to the latest secure version which addresses the insecure temporary file creation.
What software is affected by CVE-2011-1920?
CVE-2011-1920 affects the NetBSD operating system and the Ihji Pmake utility.
What type of vulnerability is CVE-2011-1920?
CVE-2011-1920 is a vulnerability involving insecure temporary file creation with predictable filenames.
Can CVE-2011-1920 lead to unauthorized access?
Yes, CVE-2011-1920 can potentially lead to unauthorized access due to the predictable nature of the temporary file names.