CVE Vulnerabilities

CVE-2009-1207

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Published: Apr 01, 2009 | Modified: Sep 29, 2017
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
4.4 MEDIUM
AV:L/AC:M/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

Race condition in the dircmp script in Sun Solaris 8 through 10, and OpenSolaris snv_01 through snv_111, allows local users to overwrite arbitrary files, probably involving a symlink attack on temporary files.

Weakness

The program contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

Affected Software

Name Vendor Start Version End Version
Opensolaris Sun snv_01 snv_01
Opensolaris Sun snv_02 snv_02
Opensolaris Sun snv_03 snv_03
Opensolaris Sun snv_04 snv_04
Opensolaris Sun snv_05 snv_05
Opensolaris Sun snv_06 snv_06
Opensolaris Sun snv_07 snv_07
Opensolaris Sun snv_08 snv_08
Opensolaris Sun snv_09 snv_09
Opensolaris Sun snv_10 snv_10
Opensolaris Sun snv_11 snv_11
Opensolaris Sun snv_12 snv_12
Opensolaris Sun snv_13 snv_13
Opensolaris Sun snv_14 snv_14
Opensolaris Sun snv_15 snv_15
Opensolaris Sun snv_16 snv_16
Opensolaris Sun snv_17 snv_17
Opensolaris Sun snv_18 snv_18
Opensolaris Sun snv_19 snv_19
Opensolaris Sun snv_20 snv_20
Opensolaris Sun snv_21 snv_21
Opensolaris Sun snv_22 snv_22
Opensolaris Sun snv_23 snv_23
Opensolaris Sun snv_24 snv_24
Opensolaris Sun snv_25 snv_25
Opensolaris Sun snv_26 snv_26
Opensolaris Sun snv_27 snv_27
Opensolaris Sun snv_28 snv_28
Opensolaris Sun snv_29 snv_29
Opensolaris Sun snv_30 snv_30
Opensolaris Sun snv_31 snv_31
Opensolaris Sun snv_32 snv_32
Opensolaris Sun snv_33 snv_33
Opensolaris Sun snv_34 snv_34
Opensolaris Sun snv_35 snv_35
Opensolaris Sun snv_36 snv_36
Opensolaris Sun snv_37 snv_37
Opensolaris Sun snv_38 snv_38
Opensolaris Sun snv_39 snv_39
Opensolaris Sun snv_40 snv_40
Opensolaris Sun snv_41 snv_41
Opensolaris Sun snv_42 snv_42
Opensolaris Sun snv_43 snv_43
Opensolaris Sun snv_44 snv_44
Opensolaris Sun snv_45 snv_45
Opensolaris Sun snv_46 snv_46
Opensolaris Sun snv_47 snv_47
Opensolaris Sun snv_48 snv_48
Opensolaris Sun snv_49 snv_49
Opensolaris Sun snv_50 snv_50
Opensolaris Sun snv_51 snv_51
Opensolaris Sun snv_52 snv_52
Opensolaris Sun snv_53 snv_53
Opensolaris Sun snv_54 snv_54
Opensolaris Sun snv_55 snv_55
Opensolaris Sun snv_56 snv_56
Opensolaris Sun snv_57 snv_57
Opensolaris Sun snv_58 snv_58
Opensolaris Sun snv_59 snv_59
Opensolaris Sun snv_60 snv_60
Opensolaris Sun snv_61 snv_61
Opensolaris Sun snv_62 snv_62
Opensolaris Sun snv_63 snv_63
Opensolaris Sun snv_64 snv_64
Opensolaris Sun snv_65 snv_65
Opensolaris Sun snv_66 snv_66
Opensolaris Sun snv_67 snv_67
Opensolaris Sun snv_68 snv_68
Opensolaris Sun snv_69 snv_69
Opensolaris Sun snv_70 snv_70
Opensolaris Sun snv_71 snv_71
Opensolaris Sun snv_72 snv_72
Opensolaris Sun snv_73 snv_73
Opensolaris Sun snv_74 snv_74
Opensolaris Sun snv_75 snv_75
Opensolaris Sun snv_76 snv_76
Opensolaris Sun snv_77 snv_77
Opensolaris Sun snv_78 snv_78
Opensolaris Sun snv_79 snv_79
Opensolaris Sun snv_80 snv_80
Opensolaris Sun snv_81 snv_81
Opensolaris Sun snv_82 snv_82
Opensolaris Sun snv_83 snv_83
Opensolaris Sun snv_84 snv_84
Opensolaris Sun snv_85 snv_85
Opensolaris Sun snv_86 snv_86
Opensolaris Sun snv_87 snv_87
Opensolaris Sun snv_88 snv_88
Opensolaris Sun snv_89 snv_89
Opensolaris Sun snv_90 snv_90
Opensolaris Sun snv_91 snv_91
Opensolaris Sun snv_92 snv_92
Opensolaris Sun snv_93 snv_93
Opensolaris Sun snv_94 snv_94
Opensolaris Sun snv_95 snv_95
Opensolaris Sun snv_96 snv_96
Opensolaris Sun snv_97 snv_97
Opensolaris Sun snv_98 snv_98
Opensolaris Sun snv_99 snv_99
Opensolaris Sun snv_100 snv_100
Opensolaris Sun snv_101 snv_101
Opensolaris Sun snv_102 snv_102
Opensolaris Sun snv_103 snv_103
Opensolaris Sun snv_104 snv_104
Opensolaris Sun snv_105 snv_105
Opensolaris Sun snv_106 snv_106
Opensolaris Sun snv_107 snv_107
Opensolaris Sun snv_108 snv_108
Opensolaris Sun snv_109 snv_109
Opensolaris Sun snv_110 snv_110
Opensolaris Sun snv_111 snv_111
Solaris Sun 8 8
Solaris Sun 9 9
Solaris Sun 10 10

Extended Description

This can have security implications when the expected synchronization is in security-critical code, such as recording whether a user is authenticated or modifying important state information that should not be influenced by an outsider. A race condition occurs within concurrent environments, and is effectively a property of a code sequence. Depending on the context, a code sequence may be in the form of a function call, a small number of instructions, a series of program invocations, etc. A race condition violates these properties, which are closely related:

A race condition exists when an “interfering code sequence” can still access the shared resource, violating exclusivity. Programmers may assume that certain code sequences execute too quickly to be affected by an interfering code sequence; when they are not, this violates atomicity. For example, the single “x++” statement may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read (the original value of x), followed by a computation (x+1), followed by a write (save the result to x). The interfering code sequence could be “trusted” or “untrusted.” A trusted interfering code sequence occurs within the program; it cannot be modified by the attacker, and it can only be invoked indirectly. An untrusted interfering code sequence can be authored directly by the attacker, and typically it is external to the vulnerable program.

Potential Mitigations

  • Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
  • Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).

References