sdiff /tmp 竞争条件漏洞发布时间：2001-10-22 更新时间：2001-10-22 严重程度：高 威胁程度：本地管理员权限 错误类型：竞争条件 利用方式：服务器模式 受影响系统 MandrakeSoft Corporate Server 1.0.1详细描述 sdiff程序存在漏洞可以导致竞争条件问题，在建立和处理/tmp目录下的文件不正确，sdiff在/tmp目录下建立的文件没有实现查看文件是否存在并使用可预测文件名，这样就可以导致攻击者使用符号连接的方法以使用sdiff用户的权利覆盖任意文件。 测试代码 尚无 解决方案 升级程序： MandrakeSoft Corporate Server 1.0.1: MandrakeSoft RPM 1.0.1 i386 diffutils-2.7-25.4mdk.i586.rpm http://sunsite.ualberta.ca/pub/Mirror/Linux/mandrake/updates/1.0.1/RPMS/diffutils-2.7-25.4mdk.i586.rpm MandrakeSoft Linux Mandrake 6.0: MandrakeSoft RPM 6.0 i386 diffutils-2.7-25.4mdk.i586.rpm http://sunsite.ualberta.ca/pub/Mirror/Linux/mandrake/updates/6.0/RPMS/diffutils-2.7-25.4mdk.i586.rpm MandrakeSoft Linux Mandrake 6.1: MandrakeSoft RPM 6.1 i386 diffutils-2.7-25.4mdk.i586.rpm http://sunsite.ualberta.ca/pub/Mirror/Linux/mandrake/updates/6.1/RPMS/diffutils-2.7-25.4mdk.i586.rpm MandrakeSoft Linux Mandrake 7.0: MandrakeSoft RPM 7.0 i386 diffutils-2.7-25.4mdk.i586.rpm http://sunsite.ualberta.ca/pub/Mirror/Linux/mandrake/updates/7.0/RPMS/diffutils-2.7-25.4mdk.i586.rpm MandrakeSoft Linux Mandrake 7.1: MandrakeSoft RPM 7.1 i386 diffutils-2.7-25.3mdk.i586.rpm http://sunsite.ualberta.ca/pub/Mirror/Linux/mandrake/updates/7.1/RPMS/diffutils-2.7-25.3mdk.i586.rpm MandrakeSoft Linux Mandrake 7.2: MandrakeSoft RPM 7.2 i386 diffutils-2.7-25.4mdk.i586.rpm http://sunsite.ualberta.ca/pub/Mirror/Linux/mandrake/updates/7.2/RPMS/diffutils-2.7-25.4mdk.i586.rpm RedHat Linux 5.2 sparc: RedHat RPM 5.2 sparc diffutils-2.7-22.5x.sparc.rpm ftp://updates.redhat.com/5.2/en/os/sparc/diffutils-2.7-22.5x.sparc.rpm RedHat Linux 5.2 i386: RedHat RPM 5.2 i386 diffutils-2.7-22.5x.i386.rpm ftp://updates.redhat.com/5.2/en/os/i386/diffutils-2.7-22.5x.i386.rpm RedHat Linux 5.2 alpha: RedHat RPM 5.2 alpha diffutils-2.7-22.5x.alpha.rpm ftp://updates.redhat.com/5.2/en/os/alpha/diffutils-2.7-22.5x.alpha.rpm RedHat Linux 6.2 sparc: RedHat RPM 6.2 sparc diffutils-2.7-22.6x.sparc.rpm ftp://updates.redhat.com/6.2/en/os/sparc/diffutils-2.7-22.6x.sparc.rpm RedHat Linux 6.2 i386: RedHat RPM 6.2 i386 diffutils-2.7-22.6x.i386.rpm ftp://updates.redhat.com/6.2/en/os/i386/diffutils-2.7-22.6x.i386.rpm RedHat Linux 6.2 alpha: RedHat RPM 6.2 alpha diffutils-2.7-22.6x.alpha.rpm ftp://updates.redhat.com/6.2/en/os/alpha/diffutils-2.7-22.6x.alpha.rpm RedHat Linux 7.0 i386: RedHat Linux 7.0 alpha: RedHat Linux 7.0: RedHat Linux 7.1 ia64: RedHat RPM 7.1 i386 diffutils-2.7-23.ia64.rpm ftp://updates.redhat.com/7.1/en/os/ia64/diffutils-2.7-23.ia64.rpm RedHat Linux 7.1 i386: RedHat RPM 7.1 i386 diffutils-2.7-23.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/diffutils-2.7-23.i386.rpm RedHat Linux 7.1 alpha: RedHat RPM 7.1 alpha diffutils-2.7-23.alpha.rpm ftp://updates.redhat.com/7.1/en/os/alpha/diffutils-2.7-23.alpha.rpm Trustix Secure Linux 1.1: Trustix RPM 1.1 i386 diffutils-2.7-18tr.i586.rpm http://www.trustix.net/pub/Trustix/updates/1.1/RPMS/diffutils-2.7-18tr.i586.rpm Trustix Secure Linux 1.2: Trustix RPM 1.2 i386 diffutils-2.7-18tr.i586.rpm http://www.trustix.net/pub/Trustix/updates/1.2/RPMS/diffutils-2.7-18tr.i586.rpm Wirex Immunix OS 7.0-Beta: Wirex RPM 7.0 i386 diffutils-2.7-21_StackGuard_2.i386.rpm http://www.immunix.org/ImmunixOS/7.0-beta/updates/RPMS/diffutils-2.7-21_StackGuard_2.i386.rpm 相关信息 Greg KH <greg@wirex.com> 参考：http://www.securityfocus.com/archive/1/038zogyeil.fsf@colargol.tihlde.hist.no |
