Executive brief
A script used to configure network settings on Red Hat Linux 5 contains a flaw that allows local users to interfere with system files. By creating a specially crafted link, an attacker can force the system to append text to sensitive files they wouldn't normally be able to modify. This could lead to minor data corruption or unauthorized changes to system logs and configuration files.
Technical details
The vulnerability exists in the 'ifdhcpc-done' script, which is executed after a DHCP interface is configured. The script appends a log message to '/tmp/dhcplog' without verifying if the file is a symbolic link. A local attacker can create a symlink at '/tmp/dhcplog' pointing to a sensitive system file. When the script runs with root privileges during network configuration, it follows the symlink and appends the string 'setting up resolv.conf' to the target file. Additionally, the log file was found to have world-writable (666) permissions by default.
Affected products
- Red Hat Linux 5.0 5.0
Timeline
- 1998-03-09: disclosed: Vulnerability reported on Bugtraq mailing list
- 1998-03-09: advisory: NVD publication date