getty_ps creates temporary files insecurely

Overview

getty_ps is an open-source software package designed to support logons to the console and terminals. Some implementations create temporary files insecurely with predictable names, leading to corruption of arbitrary files via symbolic link attack.

Description

Under certain circumstances, getty_ps will create files in the /tmp file system in an insecure manner. The program uses a naming scheme that could make it possible to guess the file name of future files in the /tmp directory, and does not check for the existence of the file before attempting to create it.

---

Impact

By creating symbolic links in /tmp with appropriate names, an attacker could cause getty_ps to overwrite files writeable by the effective UID of this package. Since this package is normally run as root, any file on the system could be thus corrupted.

---

Solution

Apply vendor patches; see the Systems Affected section below.

---

Vendor Information

342768

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Immunix __ Affected

Notified: January 10, 2001 Updated: August 17, 2001

Status

Affected

Vendor Statement

Immunix Security Advisory 2000-70-025-01

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

-----------------------------------------------------------------------

Packages updated:getty_ps Effected products:Immunix OS 7.0-beta Bugs Fixed:immunix/1317 Date:January 10, 2000 Advisory ID:IMNX-2000-70-025-01 Author:Greg Kroah-Hartman <[email protected]> -----------------------------------------------------------------------

Description: In an internal audit conducted while preparing Immunix Linux 7.0 we noticed a potential temp file race problem in the getty_ps program.
A patch has been applied that fixes this problem, however the maintainer of the program never responded to our email message about this problem.
Packages have been created and released for Immunix 7.0 beta to fix this problem.
Package names and locations: Precompiled binary package for Immunix 7.0 beta is available at: ``<http://www.immunix.org/ImmunixOS/7.0-beta/updates/RPMS/getty_ps-2.0.7j-12_StackGuard_2.i386.rpm>``
Source package for Immunix 7.0 beta is available at: ``<http://www.immunix.org/ImmunixOS/7.0-beta/updates/SRPMS/getty_ps-2.0.7j-12_StackGuard_2.src.rpm>

md5sums of the packages: ebe7518773d6598ef520233236488b7a getty_ps-2.0.7j-12_StackGuard_2.i386.rpm 22576dbf9d22ee4bb16811bddc9abd00 getty_ps-2.0.7j-12_StackGuard_2.src.rpm

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23342768 Feedback>).

MandrakeSoft __ Affected

Notified: January 10, 2001 Updated: August 17, 2001

Status

Affected

Vendor Statement

<http://www.linuxsecurity.com/advisories/mandrake_advisory-1037.html&gt;

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23342768 Feedback>).

getty_ps __ Affected

Updated: July 28, 2004

Status

Affected

Vendor Statement

The patched release will be 2.1.0a, and all future releases (2.1.0b or higher, or the scheduled 2.1.1). The fix should be released in the next 7 days.

Please note that this vulnerablity exists in all previous releases that I have copies of (going back to 2.0.4), and I assume all the way back from there.

Important PLEASE NOTE: this problem only occurs, if the package was compiled with SYSLOG_DEBUG not defined, which should not be the case in production versions. (The vunerability is caused by a debug file.) The simplest fix is to check the source code (file “tune.h”), for “#define SYSLOG” and “#define SYSLOG_DEBUG”. If present, then this vunerabilty does not exist, as the code that creates the file in question is disabled. If not present, then include these in the tune.h file, re-compile, and re-install.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23342768 Feedback>).

SuSE Inc. __ Not Affected

Notified: August 21, 2001 Updated: August 28, 2001

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The version shipped by SuSE does not appear to be vulnerable.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23342768 Feedback>).

Debian Unknown

Notified: August 21, 2001 Updated: October 01, 2001

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23342768 Feedback>).

Red Hat Inc. Unknown

Notified: August 21, 2001 Updated: October 01, 2001

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23342768 Feedback>).

Sequent Unknown

Notified: August 21, 2001 Updated: October 01, 2001

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23342768 Feedback>).

The SCO Group (SCO Linux) Unknown

Notified: August 21, 2001 Updated: October 01, 2001

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23342768 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.securityfocus.com/bid/2194&gt;
• <http://www.linuxsecurity.com/advisories/mandrake_advisory-1037.html&gt;
• <http://xforce.iss.net/xforce/xfdb/5924&gt;

Acknowledgements

This vulnerability was first reported by Greg Kroah-Hartman.

This document was written by Tim Shimeall.

Other Information

CVE IDs:	CVE-2001-0119
Severity Metric:	5.63 Date Public: