|
|
| |
| The script command which is a part of the util-linux package contains a silly hardlink vulnerability which could overwrite any file on the hard disk. 'Script' is tool to save terminal sessions for later reference. By default script creates a file called typescript for its log. |
| |
Credit:
The information has been provided by Marco van Berkum.
|
| |
When executed as root , 'Script' overwrites hardlinks that could be set by any user to any file on the hard disk. For instance, a malicious user can place a hardlink 'typescript' to /etc/passwd (or any other file) in his home directory. If the root user executes 'script' in that directory it would cause 'script' to overwrite that file. 'Script' does check for symlinks and asks if the symlink should be overwritten, it lacks checking hardlinks.
Impact:
Low, as it is not likely that root users execute 'script' in a user's home directory.
Vendor status:
Program has been fixed; the author/maintainer corrected it in the latest version.
|
|
|
