Debian Security Advisory

tcsh -- local exploit

Date Reported:

11 Nov 2000

Affected Packages:

tcsh
tcsh-i18n
tcsh-kanji

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-2000-1134.

More information:

Proton reported on bugtraq that tcsh did not handle in-here documents correctly. The version of tcsh that is distributed with Debian GNU/Linux 2.2r0 also suffered from this problem. When using in-here documents using the << syntax tcsh uses a temporary file to store the data. Unfortunately the temporary file is not created securely and standard symlink attacks can be used to make tcsh overwrite arbitrary files. This has been fixed in version 6.09.00-10 and we recommend that you upgrade your tcsh package immediately.

Fixed in:

Debian GNU/Linux 2.2 (potato)

Source:: http://security.debian.org/dists/potato/updates/main/source/tcsh_6.09.00-10.diff.gz; http://security.debian.org/dists/potato/updates/main/source/tcsh_6.09.00-10.dsc; http://security.debian.org/dists/potato/updates/main/source/tcsh_6.09.00.orig.tar.gz
Architecture-independent component:: http://security.debian.org/dists/potato/updates/main/binary-all/tcsh-i18n_6.09.00-10_all.deb
Alpha:: http://security.debian.org/dists/potato/updates/main/binary-alpha/tcsh_6.09.00-10_alpha.deb; http://security.debian.org/dists/potato/updates/main/binary-alpha/tcsh-kanji_6.09.00-10_alpha.deb
ARM:: http://security.debian.org/dists/potato/updates/main/binary-arm/tcsh_6.09.00-10_arm.deb; http://security.debian.org/dists/potato/updates/main/binary-arm/tcsh-kanji_6.09.00-10_arm.deb
Intel IA-32:: http://security.debian.org/dists/potato/updates/main/binary-i386/tcsh_6.09.00-10_i386.deb; http://security.debian.org/dists/potato/updates/main/binary-i386/tcsh-kanji_6.09.00-10_i386.deb
Motorola 680x0:: http://security.debian.org/dists/potato/updates/main/binary-m68k/tcsh_6.09.00-10_m68k.deb; http://security.debian.org/dists/potato/updates/main/binary-m68k/tcsh-kanji_6.09.00-10_m68k.deb
PowerPC:: http://security.debian.org/dists/potato/updates/main/binary-powerpc/tcsh_6.09.00-10_powerpc.deb; http://security.debian.org/dists/potato/updates/main/binary-powerpc/tcsh-kanji_6.09.00-10_powerpc.deb
Sun SPARC:: http://security.debian.org/dists/potato/updates/main/binary-sparc/tcsh_6.09.00-10_sparc.deb; http://security.debian.org/dists/potato/updates/main/binary-sparc/tcsh-kanji_6.09.00-10_sparc.deb