Description
GNU Parallel before 20150522 (Nepal), when using (1) --cat or (2) --fifo with --sshlogin, allows local users to write to arbitrary files via a symlink attack on a temporary file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | parallel | 20161222-1 | — |
| Debian 13 | parallel | 20161222-1 | — |
| Debian 12 | parallel | 20161222-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | parallel | 20161222-1~ubuntu0.16.04.1 | — |
References
- openSUSE-SU-2015:0968 vendor-advisory
- 74961 vdb-entry
- [parallel] 20150423 GNU Parallel Security Advisory: GNU Parallel can be tricked into overwriting a file mailing-list
- [parallel] 20150522 GNU Parallel 20150522 ('Nepal') released [stable] mailing-list