Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
CVE-2013-4184: Insecure usage of /tmp/.UUID_STATE and /tmp/.UUID_NODEID #5
This is a repost and update of https://rt.cpan.org/Public/Bug/Display.html?id=69277 - the bug tracker that CPAN points to appears to have changed at some point since 2011.
A symlink attack via Data::UUID is possible.
Then /home/user1/test-file is overwritten.
There are two points in UUID.xs which write to UUID_STATE_NV_STORE - both the DESTROY() and create() functions are affected.
On at least recent Debian kernels, it is necessary to disable symlink protection via "sysctl fs.protected_symlinks=0" to reproduce this issue.
A similar attack is possible via .UUID_NODEID, but only if combined with exploiting the race condition between fopen and fwrite, so this is much more difficult to reproduce.