Executive brief
A vulnerability in the GNU Compiler Collection (GCC) version 2.7.2 allows local users to corrupt or overwrite sensitive system files. By creating malicious symbolic links in temporary directories, an attacker can trick the compiler into writing data to unintended locations, such as system configuration files. This could lead to a loss of system integrity or a complete service outage if critical files are destroyed.
Technical details
A symlink vulnerability exists in GCC 2.7.2 due to insecure handling of temporary files in /tmp. While the initial temporary file (.i) is created with checks, subsequent files (.s and .o) use predictable filenames based on the same random seed without verifying if the file already exists or is a symbolic link. A local attacker can monitor /tmp for the creation of the .i file and quickly create symbolic links for the expected .s or .o filenames pointing to a target file (e.g., /etc/passwd). When GCC writes to these temporary files, it follows the symlink and overwrites the target file with assembly or object code.
Affected products
- GNU gcc 2.7.2, 2.7.2.3.f.1, 2.7.3.f.1
Timeline
- 1998-01-02: disclosed: Initial disclosure on Bugtraq by Richard Kenny
- 1998-01-02: advisory: NVD publication date