Description
Multiple shell programs on various Unix systems, including (1) tcsh, (2) csh, (3) sh, and (4) bash, follow symlinks when processing << redirects (aka here-documents or in-here documents), which allows local users to overwrite files of other users via a symlink attack.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- UUCP - File Creation/Overwriting Symlinks EDB-217 · local · Dec 4, 2000 · verified
- Apple Mac OSX 10 / HP-UX 9/10/11 / Mandriva 6/7 / RedHat 5/6 / SCO 5 / IRIX 6 - Shell Redirection Race Condition EDB-20436 · local · Jan 2, 2000 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20001111a vendor-advisory
- 1926 vdb-entry
- CLA-2000:350 vendor-advisory
- oval:org.mitre.oval:def:4047 vdb-entry signature
- SSRT1-41U vendor-advisory
- 2006 vdb-entry
- MDKSA-2000-069 vendor-advisory
- CSSA-2000-042.0 vendor-advisory
- RHSA-2000:117 vendor-advisory
- VU#10277 third-party-advisory
- 20001130 [ADV/EXP]: RH6.x root from bash /tmp vuln + MORE mailing-list
- 20001028 tcsh: unsafe tempfile in << redirects mailing-list
- MDKSA-2000:075 vendor-advisory
- CSSA-2000-043.0 vendor-advisory
- 20001128 /bin/sh creates insecure tmp files mailing-list
- CLSA-2000:354 vendor-advisory
- RHSA-2000:121 vendor-advisory