FreeBSD periodic Race Condition Privilege Escalation (CVE-2000-0890)

Vulnerability Key Information Vulnerability Overview Vulnerability ID: VU#626919 Release Date: 2000-11-13 Last Revised: 2001-03-28 Vulnerability Description The script, when used in conjunction with , executes jobs at specified time intervals. During normal operation, creates temporary files with predictable names such as , where is the process ID of the running process. Since is invoked by , it runs with elevated privileges. An attacker can exploit a race condition by querying the system to create a symbolic link from to a file of their choice, resulting in the target file being overwritten. Impact An attacker with write access to the local filesystem and the ability to discover other processes' PIDs can overwrite any file on the system, regardless of file permissions. This capability can be leveraged in many scenarios to gain root access. Solution Apply patches provided by the vendor. Vendor Information Affected: FreeBSD Unaffected: Apple, BSDI, Compaq Computer Corporation, IBM, NetBSD, OpenBSD Unknown: Caldera, Data General, Debian CVSS Score Base Score: Not provided Temporal Score: Not provided Environmental Score: Not provided References https://www.FreeBSD.org/cgi/man.cgi?query=periodic&apropos=0&sektion=0&manpath=FreeBSD+5.0-current&format=html http://www.securityfocus.com/bid/2325 Acknowledgments Thanks to David Lary of SecureWorks for reporting this vulnerability and providing technical details. Additional Information CVE ID: CVE-2000-0890 Severity Metric: 0.21 Public Disclosure Date: 2000-11-13 Initial Release Date: 2000-11-13 Last Updated: 2001-03-28 04:25 UTC Document Revision: 14

Goal Reached Thanks to every supporter — we hit 100%!

FreeBSD periodic Race Condition Privilege Escalation (CVE-2000-0890)