FreeBSD : portupgrade -- insecure temporary file handling vulnerability (22f00553-a09d-11d9-a788-0001020eed82)

High Nessus Plugin ID 18868


The remote FreeBSD host is missing a security-related update.


Simon L. Nielsen discovered that portupgrade handles temporary files in an insecure manner. This could allow an unprivileged local attacker to execute arbitrary commands or overwrite arbitrary files with the permissions of the user running portupgrade, typically root, by way of a symlink attack.

The following issues exist where the temporary files are created, by default in the world writeable directory /var/tmp, with the permissions of the user running portupgrade :

- pkg_fetch download packages with a predictable local filename allowing a local attacker to overwrite arbitrary local files or potentially replace the downloaded package after download but before install with a package with malicious content, allowing the attacker to run arbitrary commands.

- portupgrade will, when upgrading ports/packages, write the old package to a predictable temporary file, allowing an attacker to overwrite arbitrary files via a symlink attack.

- portupgrade will touch a temporary file with a constant filename (pkgdb.fixme) allowing an attacker to create arbitrary zero-byte files via a symlink attack.

A workaround for these issues is to set the PKG_TMPDIR environment variable to a directory only write-able by the user running portupgrade.


Update the affected package.

See Also

Plugin Details

Severity: High

ID: 18868

File Name: freebsd_pkg_22f00553a09d11d9a7880001020eed82.nasl

Version: $Revision: 1.13 $

Type: local

Published: 2005/07/13

Modified: 2013/06/21

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 7.2

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:portupgrade, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 2005/04/12

Vulnerability Publication Date: 2005/04/12

Reference Information

CVE: CVE-2005-0610