Executive brief
A vulnerability in the 'sort' utility, commonly used by system maintenance tasks like 'updatedb', allows local users to corrupt or overwrite sensitive system files. By predicting the names of temporary files created during sorting processes, an attacker can redirect data into critical files such as password databases or system configurations. This can lead to a complete system compromise or a denial of service by destroying essential operating system data.
Technical details
The 'sort' utility (often GNU sort) creates temporary files in /tmp using predictable naming conventions (e.g., sortPID0001). Because the utility follows symbolic links when opening these temporary files, a local attacker can perform a symlink race attack. By creating a symbolic link at the predicted temporary file path pointing to a sensitive target (like /etc/shadow), the attacker can force the 'sort' process to overwrite that target with sorted data. This is particularly critical when 'sort' is invoked by root-privileged cron jobs such as 'updatedb'. The vulnerability was addressed in later versions of Red Hat and SuSE by modifying how temporary files are handled or how the calling scripts are executed.
Affected products
- Red Hat Linux 4.1, 4.2
- SuSE Linux 5.0, 4.4.1
- Slackware Linux 3.3
- FreeBSD Project FreeBSD 2.2.2
Timeline
- 1997-08-05: advisory: KSR[T] Advisory #003 released
- 1997-10-06: disclosed: Initial disclosure date listed in NVD
- 1998-03-02: other: Additional exploitation details shared on Bugtraq regarding updatedb symlinks