CVE-2006-6939
published 2007-01-17CVE-2006-6939: GNU ed before 0.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files, possibly in the open_sbuf function.
PriorityP413medium4.6CVSS 2.0
AVLACLAuNCPIPAP
EPSS
0.37%
28.9th percentile
GNU ed before 0.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files, possibly in the open_sbuf function.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ed | < ed 0.2-19 (bookworm) | ed 0.2-19 (bookworm) |
| gnu | ed | <= 0.2 | — |
| gnu | ed | >= 0 < 0.2-19 | 0.2-19 |
| gnu | ed | >= 0 < 0.2-19 | 0.2-19 |
| gnu | ed | >= 0 < 0.2-19 | 0.2-19 |
| gnu | ed | >= 0 < 0.2-19 | 0.2-19 |
CVSS provenance
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
osv4.6MEDIUM
vendor_debian4.6MEDIUM
vendor_redhat4.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
CVE-2006-6939 Insecure use of temporary file in ed
vendor_redhat·2007-11-11·CVSS 4.6
CVE-2006-6939 [MEDIUM] CVE-2006-6939 Insecure use of temporary file in ed
CVE-2006-6939 Insecure use of temporary file in ed
GNU ed before 0.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files, possibly in the open_sbuf function.
Statement: Red Hat is aware of this issue and is tracking it via the following bug:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=223072
The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw.
Debian
CVE-2006-6939: ed - GNU ed before 0.3 allows local users to overwrite arbitrary files via a symlink ...
vendor_debian·2006·CVSS 4.6
CVE-2006-6939 [MEDIUM] CVE-2006-6939: ed - GNU ed before 0.3 allows local users to overwrite arbitrary files via a symlink ...
GNU ed before 0.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files, possibly in the open_sbuf function.
Scope: local
bookworm: resolved (fixed in 0.2-19)
bullseye: resolved (fixed in 0.2-19)
forky: resolved (fixed in 0.2-19)
sid: resolved (fixed in 0.2-19)
trixie: resolved (fixed in 0.2-19)
GHSA
GHSA-q7jc-952h-fjg4: GNU ed before 0
ghsa_unreviewed·2022-05-01
CVE-2006-6939 [MEDIUM] GHSA-q7jc-952h-fjg4: GNU ed before 0
GNU ed before 0.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files, possibly in the open_sbuf function.
OSV
CVE-2006-6939: GNU ed before 0
osv·2007-01-17·CVSS 4.6
CVE-2006-6939 [MEDIUM] CVE-2006-6939: GNU ed before 0
GNU ed before 0.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files, possibly in the open_sbuf function.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2006-6939 Insecure use of temporary file in ed
bugzilla·2007-01-17·CVSS 4.6
CVE-2006-6939 [MEDIUM] CVE-2006-6939 Insecure use of temporary file in ed
CVE-2006-6939 Insecure use of temporary file in ed
+++ This bug was initially created as a clone of Bug #223072 +++
Description of problem:
Version 0.3 of GNU ed replaced use of unsecure mktemp() followed
by fopen() in buf.c:open_sbuf() with tmpnam(). The former construction
is vulnerable to race condition, where a malicous user can create
the temporary file between two function calls, as they are non-atomic,
and then either read or write the contents of the file, or make it
a symbolic link to a file owned by the victim resulting in its overite.
Version-Release number of selected component (if applicable):
GNU ed 0.2, in RHEL{2.1,3,4,5} and FC{5,6}
How reproducible:
Time-dependent race condition, very unlikely.
Steps to Reproduce:
1. Attempt to guess the filename returned by mktemp
Bugzilla
CVE-2006-6939 Insecure use of temporary file in ed
bugzilla·2007-01-17·CVSS 4.6
CVE-2006-6939 [MEDIUM] CVE-2006-6939 Insecure use of temporary file in ed
CVE-2006-6939 Insecure use of temporary file in ed
Description of problem:
Version 0.3 of GNU ed replaced use of unsecure mktemp() followed
by fopen() in buf.c:open_sbuf() with tmpnam(). The former construction
is vulnerable to race condition, where a malicous user can create
the temporary file between two function calls, as they are non-atomic,
and then either read or write the contents of the file, or make it
a symbolic link to a file owned by the victim resulting in its overite.
Version-Release number of selected component (if applicable):
GNU ed 0.2, in RHEL{2.1,3,4,5} and FC{5,6}
How reproducible:
Time-dependent race condition, very unlikely.
Steps to Reproduce:
1. Attempt to guess the filename returned by mktemp() and attempt
create it while being schelduled between mktemp() a
Bugzilla
CVE-2006-6939 Insecure use of temporary file in ed
bugzilla·2007-01-17·CVSS 4.6
CVE-2006-6939 [MEDIUM] CVE-2006-6939 Insecure use of temporary file in ed
CVE-2006-6939 Insecure use of temporary file in ed
+++ This bug was initially created as a clone of Bug #223072 +++
Description of problem:
Version 0.3 of GNU ed replaced use of unsecure mktemp() followed
by fopen() in buf.c:open_sbuf() with tmpnam(). The former construction
is vulnerable to race condition, where a malicous user can create
the temporary file between two function calls, as they are non-atomic,
and then either read or write the contents of the file, or make it
a symbolic link to a file owned by the victim resulting in its overite.
Version-Release number of selected component (if applicable):
GNU ed 0.2, in RHEL{2.1,3,4,5} and FC{5,6}
How reproducible:
Time-dependent race condition, very unlikely.
Steps to Reproduce:
1. Attempt to guess the filename returned by mktemp
CAPEC
Leveraging Race Conditions via Symbolic Links
mitre_capec
[HIGH] Leveraging Race Conditions via Symbolic Links
CAPEC-27: Leveraging Race Conditions via Symbolic Links
This attack leverages the use of symbolic links (Symlinks) in order to write to sensitive files. An attacker can create a Symlink link to a target file not otherwise accessible to them. When the privileged program tries to create a temporary file with the same name as the Symlink link, it will actually write to the target file pointed to by the attackers' Symlink link. If the attacker can insert malicious content in the temporary file they will be writing to the sensitive file by using the Symlink. The race occurs because the system checks if the temporary file exists, then creates the file. The attacker would typically create the Symlink during the interval between the check and the creation of the temporary file.
Execution Flow:
S
http://fedoranews.org/cms/node/2449http://fedoranews.org/cms/node/2450http://freshmeat.net/projects/ed/?branch_id=17855&release_id=240890http://secunia.com/advisories/23832http://secunia.com/advisories/23848http://secunia.com/advisories/23857http://secunia.com/advisories/24054http://www.mandriva.com/security/advisories?name=MDKSA-2007:023http://www.securityfocus.com/bid/22129http://www.trustix.org/errata/2007/0005http://www.vupen.com/english/advisories/2006/4573https://exchange.xforce.ibmcloud.com/vulnerabilities/30374https://issues.rpath.com/browse/RPL-962http://fedoranews.org/cms/node/2449http://fedoranews.org/cms/node/2450http://freshmeat.net/projects/ed/?branch_id=17855&release_id=240890http://secunia.com/advisories/23832http://secunia.com/advisories/23848http://secunia.com/advisories/23857http://secunia.com/advisories/24054http://www.mandriva.com/security/advisories?name=MDKSA-2007:023http://www.securityfocus.com/bid/22129http://www.trustix.org/errata/2007/0005http://www.vupen.com/english/advisories/2006/4573https://exchange.xforce.ibmcloud.com/vulnerabilities/30374https://issues.rpath.com/browse/RPL-962
2007-01-17
Published