Utempter allows device names that contain .. (dot dot) directory traversal sequences, which allows local users to overwrite arbitrary files via a symlink attack on device names in combination with an application that trusts the utmp or wtmp files.

New utempter packages are available for Slackware 9.1 and -current to fix a security issue. (Slackware 9.1 was the first version of Slackware to use the libutempter library, and earlier versions of Slackware are not affected by this issue) The utempter package provides a utility and shared library that allows terminal applications such as xterm and screen to update /var/run/utmp and /var/log/wtmp without requiring root privileges. Steve Grubb has identified an issue with utempter-0.5.2 where under certain circumstances an attacker could cause it to overwrite files through a symlink. This has been addressed by upgrading the utempter package to use Dmitry V. Levin's new implementation of libutempter that does not have this bug.

The remote host is affected by the vulnerability described in GLSA-200405-05 (Utempter symlink vulnerability)

    Utempter contains a vulnerability that may allow local users to overwrite     arbitrary files via a symlink attack.
  Impact :

    This vulnerability may allow arbitrary files to be overwritten with root     privileges.
  Workaround :

    There is no known workaround at this time. All users are advised to upgrade     to the latest available version of utempter.

Steve Grubb discovered two potential issues in the utempter program :

1) If the path to the device contained /../ or /./ or //, the program was not exiting as it should. It would be possible to use something like /dev/../tmp/tty0, and then if /tmp/tty0 were deleted and symlinked to another important file, programs that have root privileges that do no further validation can then overwrite whatever the symlink pointed to.

2) Several calls to strncpy without a manual termination of the string. This would most likely crash utempter.

The updated packages are patched to correct these problems.

Update :

The second portion of the patch to address the manual termination of the string has been determined to be uneccessary, as well as reducing the length of utmp strings by one character. As such, it has been removed.

An updated utempter package that fixes a potential symlink vulnerability is now available.

Utempter is a utility that allows terminal applications such as xterm and screen to update utmp and wtmp without requiring root privileges.

Steve Grubb discovered a flaw in Utempter which allowed device names containing directory traversal sequences such as '/../'. In combination with an application that trusts the utmp or wtmp files, this could allow a local attacker the ability to overwrite privileged files using a symlink.

Users should upgrade to this new version of utempter, which fixes this vulnerability.

ID	Name	Product	Family	Severity
18769	Slackware 9.1 / current : utempter security update (SSA:2004-110-01)	Nessus	Slackware Local Security Checks	low
14491	GLSA-200405-05 : Utempter symlink vulnerability	Nessus	Gentoo Local Security Checks	low
14130	Mandrake Linux Security Advisory : utempter (MDKSA-2004:031-1)	Nessus	Mandriva Local Security Checks	low
12490	RHEL 2.1 / 3 : utempter (RHSA-2004:174)	Nessus	Red Hat Local Security Checks	low

Detections

Analytics

CVE-2004-0233

medium

Tenable Plugins

low

low

low

low