parallel: file overwrites
| Package(s): | parallel | CVE #(s): | |||||||||
| Created: | April 25, 2016 | Updated: | April 27, 2016 | ||||||||
| Description: | From the Red Hat bugzilla:
Race condition vulnerability lies in GNU Parallel's way of creating temporary files while at the same time trying to remove these ASAP, so if GNU Parallel is stopped, there will be no temporary files to clean up. A local attacker can exploit this issue to overwrite a file with one byte file. If an attacker sees the temporary file being created, and then removed, he has 15 ms to create a symlink with the same name to a file owned by the user. And if the file is then being recreated this will overwrite the user's file. GNU Parallel is vulnerable when using --pipe, --tmux, --cat, --fifo, or --compress. This issue was partly fixed in 20150422 and fully fixed in 20150522. See the GNU Parallel advisory for more details. | ||||||||||
| Alerts: |
| ||||||||||