REDHAT-BUG-746713: Low severity Openwall hardlink vulnerability
It was reported, that hardlink, the tool for consolidation of duplicate files via hardlinks operated on full file system objects path names. A local attacker could use this flaw to conduct symlink attacks (cause the hardlink executable to operate on directories / files outside of the intended directory tree).
References: [1] http://www.openwall.com/lists/oss-security/2011/10/15/2 [2] https://bugs.gentoo.org/showbug.cgi?id=387269 [3] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=645516
Proposed patch (applied by the Owl Linux distribution): [Adds section BUGS into the hardlink(1) man page documenting the danger] [4] http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/hardlink/hardlink.1.diff?r1=1.1;r2=1.2
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-746713?
REDHAT-BUG-746713 is considered a high severity vulnerability, as it allows local attackers to conduct symlink attacks.
How do I fix REDHAT-BUG-746713?
To fix REDHAT-BUG-746713, ensure that you are using an updated version of the Openwall hardlink software, which includes patches addressing this vulnerability.
Who is affected by REDHAT-BUG-746713?
Users of the Openwall hardlink utility are affected by REDHAT-BUG-746713, particularly those that allow local access to execute the tool.
What is a symlink attack in the context of REDHAT-BUG-746713?
A symlink attack in the context of REDHAT-BUG-746713 refers to the exploitation of the hardlink executable to manipulate file system paths, leading to unintended file access.
What are the implications of not addressing REDHAT-BUG-746713?
Not addressing REDHAT-BUG-746713 can lead to unauthorized access to sensitive files and directories by local attackers leveraging symlink vulnerabilities.