rc.sysinit in initscripts 8.12-8.21 and 8.56.15-0.1 on rPath allows local users to delete arbitrary files via a symlink attack on a directory under (1) /var/lock or (2) /var/run. NOTE: this issue exists because of a race condition in an incorrect fix for CVE-2008-3524. NOTE: exploitation may require an unusual scenario in which rc.sysinit is executed other than at boot time.
Description of problem:
Description of problem:
/etc/rc.sysinit makes
| find -L /var/lock /var/run ! -type d -exec rm -f {} \;
at every start. It is common practice to have daemon-writable subdirs below /var/run or /var/lock (e.g. /var/run/openldap). When such a daemon is compromised, an attack could create a
| /var/run/openldap/foo -> /
symlink which wipes whole system at next startup.
Version-Release number of selected component (if applicable):
initscripts-8.76.2-1.x8664
How reproducible:
100%
Steps to Reproduce: 1. mkdir /var/run/foo 2. chown nobody:nobody /var/run/foo 3. runuser nobody -s /bin/sh 'ln -s / /var/run/foo/bar' 4. reboot
Actual results:
a lot of 'command not found' errors on startup
Additional info:
Kudos to Herbert Poetzl about discovering this vulnerability.
Description of problem:
Description of problem:
/etc/rc.sysinit makes
| find -L /var/lock /var/run ! -type d -exec rm -f {} \;
at every start. It is common practice to have daemon-writable subdirs below /var/run or /var/lock (e.g. /var/run/openldap). When such a daemon is compromised, an attack could create a
| /var/run/openldap/foo -> /
symlink which wipes whole system at next startup.
Version-Release number of selected component (if applicable):
initscripts-8.76.2-1.x8664
How reproducible:
100%
Steps to Reproduce: 1. mkdir /var/run/foo 2. chown nobody:nobody /var/run/foo 3. runuser nobody -s /bin/sh 'ln -s / /var/run/foo/bar' 4. reboot
Actual results:
a lot of 'command not found' errors on startup
Additional info:
Kudos to Herbert Poetzl about discovering this vulnerability.