Bugzilla Syncshadowdb Temporary File Symbolic Link Vulnerability
29 Dec. 2005
Summary
"Bugzilla is a "Defect Tracking System" or "Bug-Tracking System"." By using PID number in a creation of a temporary file, attackers can use the temporary file to perform a symbolic link attack, and execute arbitrary programs or delete content of existent files.
Vulnerable Systems:
* Bugzilla version 2.9 and newer
* Bugzilla version 2.16.10 or prior
Immune Systems:
* Bugzilla version 2.16.11
Bugzilla contains a script which is used to synchronize the Bugzilla user database with the shadow password database called syncshadowdb. This script is intended to be running by the Bug Tracking System.
The script uses temporary files in an unsafe way since it selects a name for the file based on PID and does not make any effort to determine if the file exists and if it is a symlink. A local user could use this
to direct symlink attacks and overwrite files that the Bug Tracking System has access to.
