Home page logo

bugtraq logo Bugtraq mailing list archives

AIX/Gradient iFOR/LS bug: follows symlinks
From: schuma () GAERTNER DE (Joerg Schumacher)
Date: Mon, 9 Feb 1998 23:32:45 +0100

AIX 4.1 includes the iFOR/LS (formerly known as NetLS) license server
from Gradient Technologies.  Some parts of this system (NCS, server and
client libs) use a cache file (/tmp/last_uuid, mode 0666), which will be
created on the fly if missing.  The code has the classical file open bug:
it will happily follow any symlink.

I guess IBM and Gradient had their chance to fix this bug, since I
reported it back in december 1996 (no typo, more than a year ago).
IIRC, HP-UX had (and may still have) this bug too.

Some complaints:

   to IBM: I guess it's time to review the APAR process wrt security.
           Having a security related bug hanging around for more than a
           year at low priority is definitely a bad thing.

   to IBM-ERS: I've submitted a Cc of my original bug report to
               ers-tech () vnet ibm com but I never got any feedback.
               Granted, you don't want to us to send any reports via
               email, but this "small planet" isn't small enough to let me
               call you via phone for free.

   to DFN-CERT: Where have you been?  No tracking seen despite my Cc.

Thanks to Troy Bollinger (troy () austin ibm com) for pointing out some
other insecurely created temporary files.


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]