CVE-2000-1137
published 2001-01-09CVE-2000-1137: GNU ed before 0.2-18.1 allows local users to overwrite the files of other users via a symlink attack.
PriorityP46medium4.6CVSS 2.0
AVLACLAuNCPIPAP
EPSS
0.39%
31.3th percentile
GNU ed before 0.2-18.1 allows local users to overwrite the files of other users via a symlink attack.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gnu | ed | — | — |
| gnu | ed | — | — |
| gnu | ed | — | — |
| gnu | ed | — | — |
| chrome_chrome | — | — |
CVSS provenance
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat4.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qpw8-2v6f-pwj8: GNU ed before 0
ghsa_unreviewed·2022-04-30
CVE-2000-1137 [MEDIUM] GHSA-qpw8-2v6f-pwj8: GNU ed before 0
GNU ed before 0.2-18.1 allows local users to overwrite the files of other users via a symlink attack.
Chrome
Stable Channel Update for Desktop: CVE-2022-1136
vendor_chrome·2022-03-29·CVSS 8.8
CVE-2022-1136 [MEDIUM] Stable Channel Update for Desktop: CVE-2022-1136
Stable Channel Update for Desktop
CVE-2022-1136: Use after free in Tab Strip . Reported by Krace on 2021-12-15 [$5000][ 1289846 ] Medium CVE-2022-1137: Inappropriate implementation in Extensions
Reported by Thomas Orlita on 2022-01-22 [$2000][ 1246188 ] Medium CVE-2022-1138: Inappropriate implementation in Web Cursor
Severity: medium
Red Hat
security flaw
vendor_redhat·2000-11-29·CVSS 4.6
CVE-2000-1137 [MEDIUM] security flaw
security flaw
GNU ed before 0.2-18.1 allows local users to overwrite the files of other users via a symlink attack.
Statement: Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.
No detection rules found.
Bugzilla
CVE-2000-1137 security flaw
bugzilla·2018-08-16·CVSS 4.6
CVE-2000-1137 [MEDIUM] CVE-2000-1137 security flaw
CVE-2000-1137 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
GNU ed before 0.2-18.1 allows local users to overwrite the files of other users via a symlink attack.
---
Statement:
Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.
Bugzilla
CVE-2006-6939 Insecure use of temporary file in ed
bugzilla·2007-01-17·CVSS 4.6
CVE-2006-6939 [MEDIUM] CVE-2006-6939 Insecure use of temporary file in ed
CVE-2006-6939 Insecure use of temporary file in ed
Description of problem:
Version 0.3 of GNU ed replaced use of unsecure mktemp() followed
by fopen() in buf.c:open_sbuf() with tmpnam(). The former construction
is vulnerable to race condition, where a malicous user can create
the temporary file between two function calls, as they are non-atomic,
and then either read or write the contents of the file, or make it
a symbolic link to a file owned by the victim resulting in its overite.
Version-Release number of selected component (if applicable):
GNU ed 0.2, in RHEL{2.1,3,4,5} and FC{5,6}
How reproducible:
Time-dependent race condition, very unlikely.
Steps to Reproduce:
1. Attempt to guess the filename returned by mktemp() and attempt
create it while being schelduled between mktemp() a
Bugzilla
CVE-2006-6939 Insecure use of temporary file in ed
bugzilla·2007-01-17·CVSS 4.6
CVE-2006-6939 [MEDIUM] CVE-2006-6939 Insecure use of temporary file in ed
CVE-2006-6939 Insecure use of temporary file in ed
+++ This bug was initially created as a clone of Bug #223072 +++
Description of problem:
Version 0.3 of GNU ed replaced use of unsecure mktemp() followed
by fopen() in buf.c:open_sbuf() with tmpnam(). The former construction
is vulnerable to race condition, where a malicous user can create
the temporary file between two function calls, as they are non-atomic,
and then either read or write the contents of the file, or make it
a symbolic link to a file owned by the victim resulting in its overite.
Version-Release number of selected component (if applicable):
GNU ed 0.2, in RHEL{2.1,3,4,5} and FC{5,6}
How reproducible:
Time-dependent race condition, very unlikely.
Steps to Reproduce:
1. Attempt to guess the filename returned by mktemp
Bugzilla
CVE-2000-1137 ed uses mktemp + fopen for scratch files
bugzilla·2000-11-29·CVSS 4.6
CVE-2000-1137 [MEDIUM] CVE-2000-1137 ed uses mktemp + fopen for scratch files
CVE-2000-1137 ed uses mktemp + fopen for scratch files
Noticed from www.linuxtoday.com that debian has fixed ed.
Ed uses mktemp+fopen (buf.c:209) to create a temporary file.
Fix would be to use mkstemp+fdopen.
Discussion:
*** Bug 223072 has been marked as a duplicate of this bug. ***
---
*** Bug 223076 has been marked as a duplicate of this bug. ***
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000359http://www.debian.org/security/2000/20001129http://www.linux-mandrake.com/en/security/MDKSA-2000-076.php3http://www.osvdb.org/6491http://www.redhat.com/support/errata/RHSA-2000-123.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/5723http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000359http://www.debian.org/security/2000/20001129http://www.linux-mandrake.com/en/security/MDKSA-2000-076.php3http://www.osvdb.org/6491http://www.redhat.com/support/errata/RHSA-2000-123.htmlhttps://exchange.xforce.ibmcloud.com/vulnerabilities/5723
2001-01-09
Published