Bug 157047 – www-servers/thttpd Insecure temporary file creation (CVE-2006-4248)

• Status: RESOLVED INVALID
• Product: Gentoo Security

[Description Sune Kloppenborg Jeppesen (RETIRED) 2006-12-03 22:39:00 UTC]

Not sure wether we already fixed this one.

thttpd on Debian GNU/Linux, and possibly other distributions, allows local users to create or touch arbitrary files via a symlink attack on the start_thttpd temporary file.

[Comment 1 Elfyn McBratney (beu) (RETIRED) 2006-12-08 13:29:02 UTC]

That CVE doesn't tell me much - any clue on how I can (try to) reproduce this?

[Comment 2 Matthias Geerdsen (RETIRED) 2006-12-14 07:50:02 UTC]

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=396277

<quote>
Insecure use of /tmp in /etc/logrotate.d/thttpd:

        if pidof thttpd 2>&1 > /dev/null; then
            touch /tmp/start_thttpd
        fi

By creating a /tmp/start_thttpd symlink a local attacker will be able to
create/touch any file as root.
</quote>

[Comment 3 Matthias Geerdsen (RETIRED) 2007-01-22 19:47:33 UTC]

does not seem like the ebuild even provides a conf file for logrotate, so I guess we can close this if somebody confirms

[Comment 4 Raphael Marichez (Falco) (RETIRED) 2007-02-10 20:47:09 UTC]

(In reply to comment #3)
> does not seem like the ebuild even provides a conf file for logrotate, so I
> guess we can close this if somebody confirms
> 

i can confirm. Feel free to reopen if you disagree