Bugzilla 'syncshadowdb' Unsafe Temporary Files May Let Local Users Gain Elevated Privileges
|
|
SecurityTracker Alert ID: 1015411
|
|
SecurityTracker URL: http://securitytracker.com/id?1015411
|
|
CVE Reference: CVE-2005-4534
(Links to External Site)
|
Updated: Dec 28 2005
|
Original Entry Date: Dec 27 2005
|
Impact: Modification of system information, Modification of user information, User access via local system
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 2.6.10 and prior versions
|
Description: A vulnerability was reported in Bugzilla in the 'syncshadowdb' script. A local user can obtain elevated privileges.
The 'syncshadowdb' script uses temporary files in an unsafe manner. A local user can create a symbolic link (symlink) from a critical
file on the system to a temporary file to be used by the script. Then, when the script is executed by the bug tracking system,
the symlinked file will be created or overwritten with the privileges of the bug tracking system.
Javier Fernandez-Sanguino Pena
reported this vulnerability.
|
Impact: A local user can obtain the privileges of the bug tracking system.
|
Solution: A patch is available at:
https://bugzilla.mozilla.org/show_bug.cgi?id=305353
The fix will be included in the pending 2.16.11
version.
Versions 2.18.* and 2.20.* are not affected.
The vendor's advisory is available at:
http://www.bugzilla.org/security/2.16.10-nr/
|
Vendor URL: www.bugzilla.org/security/2.16.10-nr/ (Links to External Site)
|
Cause: Access control error, State error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Mon, 26 Dec 2005 08:11:29 -0500
Subject: Re: bugzilla security update for sarge (2.16.7-7sarge2)
|
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=329387
|
|
