The lvmcreate_initrd script in the lvm package in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files.

Recently, Trustix Secure Linux discovered a vulnerability in a supplemental script of the lvm10 package. The program 'lvmcreate_initrd' created a temporary directory in an insecure way, which could allow a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Trustix developers discovered that the lvmcreate_initrd script, part of the lvm1 package, created a temporary directory in an insecure manner. This could allow for a symlink attack to create or overwrite arbitrary files with the privileges of the user running the script.

The updated packages have been patched to prevent this problem.

The remote host is affected by the vulnerability described in GLSA-200411-22 (Davfs2, lvm-user: Insecure tempfile handling)

    Florian Schilhabel from the Gentoo Linux Security Audit Team found     that Davfs2 insecurely created .pid files in /tmp. Furthermore, Trustix     Secure Linux found that the lvmcreate_initrd script, included in the     lvm-user Gentoo package, also creates temporary files in     world-writeable directories with predictable names.
  Impact :

    A local attacker could create symbolic links in the temporary     files directory, pointing to a valid file somewhere on the filesystem.
    When Davfs2 or lvmcreate_initrd is called, this would result in the     file being overwritten with the rights of the user running the     software, which could be the root user.
  Workaround :

    There is no known workaround at this time.

Trustix developers discovered insecure temporary file creation in a supplemental script in the lvm10 package that didn't check for existing temporary directories, allowing local users to overwrite files via a symlink attack.

ID	Name	Product	Family	Severity
20547	Ubuntu 4.10 : lvm10 vulnerability (USN-15-1)	Nessus	Ubuntu Local Security Checks	low
15917	Mandrake Linux Security Advisory : lvm (MDKSA-2004:144)	Nessus	Mandriva Local Security Checks	low
15723	GLSA-200411-22 : Davfs2, lvm-user: Insecure tempfile handling	Nessus	Gentoo Local Security Checks	low
15681	Debian DSA-583-1 : lvm10 - insecure temporary directory	Nessus	Debian Local Security Checks	low

Detections

Analytics

CVE-2004-0972

medium

Tenable Plugins

low

low

low

low