what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New


Posted May 3, 2007
Authored by Timothy D. Morgan | Site vsecurity.com

Virtual Security Research, LLC. Security Advisory - A Time-of-Check-Time-of-Use file race condition exists in AFFLIB versions 2.2.0 through 2.2.8.

tags | advisory
advisories | CVE-2007-2056
SHA-256 | 198a217781a92be69e6ee7057a6ba2ab8414efcd5535a2834fc9fd680333a5e1


Change Mirror Download
Hash: SHA1

Virtual Security Research, LLC.
Security Advisory

- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Advisory Name: Time-of-Check-Time-of-Use File Race in AFFLIB
Release Date: 2007-04-27
Application: AFFLIB(TM)
Versions: 2.2.0-2.2.8 and likely earlier versions.
Severity: Low
Author: Timothy D. Morgan <tmorgan {at} vsecurity {dot} com>
Vendor Status: Vendor Notified
CVE Candidate: CVE-2007-2056
- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Product Description:

> From the forensicswiki.org website[1]:

"The Advanced Forensics Format (AFF) is an extensible open format for
the storage of disk images and related forensic metadata. It was
developed by Simson Garfinkel and Basis Technology."

AFFLIB(TM) is the reference implementation of the AFF(TM) format,
written primarily by Simson Garfinkel. It comes in the form of an open
source library and a set of command line tools used to manipulate
AFF(TM) files.

Vulnerability Overview:

In mid-March, 2007 Virtual Security Research, LLC (VSR) performed a
security code review of AFFLIB(TM) as a part of an internal tool
assessment process. As a result, multiple vulnerabilities of varying
severities were discovered. The most significant of these
vulnerabilities are being announced publicly to raise awareness and help
end-users secure themselves against potential attack.

A time-of-check-time-of-use race was discovered in AFFLIB(TM) which
could allow an attacker on the local machine to overwrite an arbitrary
file. Because the content of the file would not be controllable by an
attacker, it is unlikely that this is vulnerability is exploitable for
more than a denial-of-service.

This vulnerability remains in the latest version (2.2.8) despite several
notifications to the vendor. All line numbers listed below are from
version 2.2.0.

Vulnerability Details:

File: aimage/aimage.cpp
Lines: 554-575
Platforms Affected: Unix

A mostly predictable name for the lockfile as it is created under
/tmp. An access check is first performed, and later the file is opened,
truncating if it already exists. Since the time of check and time of use
are not the same, a filesystem race could be exploited by a local
attacker through the use of a symlink. Lines 548-582 are included below
to illustrate the problem:

int getlock(class imager *im)
/* If the file exists and the PID in the file is running,
* can't get the lock.
char lockfile[MAXPATHLEN];
/* Lockfile exists. Get it's pid */
char buf[1024];
FILE *f = fopen(lockfile,"r");
perror(lockfile); // can't read lockfile...
return -1;
buf[sizeof(buf)-1] = 0;
int pid = atoi(buf);
/* PID is not running; we can delete the lockfile */
err(1,"could not delete lockfile %s: ",lockfile);
/* PID is running; generate error */
errx(1,"%s is locked by process %d\n",im->infile,pid);
FILE *f = fopen(lockfile,"w");
fprintf(f,"%d\n",getpid()); // save our PID.
return 0;

This is likely only exploitable for a denial-of-service condition, since
the attacker would have little control over the content being written
(the process ID of aimage).

Vendor Response:

Simson Garfinkel was first contacted on 2007-03-31. The following
timeline outlines the responses from the vendor regarding this issue:

2007-04-01 - Vendor provided details of all vulnerabilities
2007-04-03 - Continued vendor communication.
2007-04-05 - Vendor released version 2.2.6, containing multiple
security fixes.
2007-04-06 - Vendor notified VSR that fixes were released.
2007-04-09 - VSR notified vendor that 9 vulnerability instances still
remained in latest release.
2007-04-12 - Vendor confirmed that remaining vulnerabilities would be
fixed in next release.
2007-04-25 - Vendor released versions 2.2.7 and 2.2.8. Vendor did not
notify VSR.
2007-04-27 - VSR discovered new versions were released. VSR inspected
version 2.2.8 and found that no additional vulnerabilities
were fixed. VSR advisories published.


AFFLIB(TM) users should upgrade to the newest version. Third-party
projects which rely on AFFLIB(TM) should encourage users to upgrade,
and/or incorporate fixes into their distribution of the library.

The update is available via:


- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Common Vulnerabilities and Exposures (CVE) Information:

The Common Vulnerabilities and Exposures (CVE) project has assigned
the following name to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems.


- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-


1. AFF - Forensics Wiki

- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

This advisory is distributed for educational purposes only, and comes
with absolutely NO WARRANTY; not even the implied warranty of
merchantability or fitness for a particular purpose. Virtual Security
Research, LLC nor the author accepts any liability for any direct,
indirect, or consequential loss or damage arising from use of, or
reliance on, this information.

- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Vulnerability Disclosure Policy:


- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

AFF(TM) and AFFLIB(TM) are trademarks of Simson Garfinkel and Basis
Technology Corp.

Included source code excerpts are copyright Simson Garfinkel and Basis
Technology Corp.

This advisory is copyright (C) 2007 Virtual Security Research, LLC. All
rights reserved.
Version: GnuPG v1.4.6 (GNU/Linux)

Login or Register to add favorites

File Archive:

September 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    2 Files
  • 2
    Sep 2nd
    21 Files
  • 3
    Sep 3rd
    0 Files
  • 4
    Sep 4th
    17 Files
  • 5
    Sep 5th
    34 Files
  • 6
    Sep 6th
    29 Files
  • 7
    Sep 7th
    11 Files
  • 8
    Sep 8th
    25 Files
  • 9
    Sep 9th
    0 Files
  • 10
    Sep 10th
    0 Files
  • 11
    Sep 11th
    26 Files
  • 12
    Sep 12th
    23 Files
  • 13
    Sep 13th
    17 Files
  • 14
    Sep 14th
    22 Files
  • 15
    Sep 15th
    16 Files
  • 16
    Sep 16th
    0 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    19 Files
  • 19
    Sep 19th
    60 Files
  • 20
    Sep 20th
    23 Files
  • 21
    Sep 21st
    15 Files
  • 22
    Sep 22nd
    8 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    17 Files
  • 26
    Sep 26th
    3 Files
  • 27
    Sep 27th
    13 Files
  • 28
    Sep 28th
    5 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Security Services
Hosting By