CVE-2000-0151

• BID:981
• URL:http://www.securityfocus.com/bid/981
• SUSE:20000209 make-3.77-44

 Frech> XF:gnu-makefile-tmp-root
   (We have made assignment to two CANs. Requesting confirmation that this is
   not a duplicate of CVE-2000-0092: The BSD make program allows local users to
   modify files via a symlink attack when the -j option is being used.)
 Christey> To confirm Andre's question, this is being treated as
   different from CVE-2000-0092, based largely on the fact
   that the exploit is different.  I believe there was
   another reason for keeping these distinct, but that
   "deeper analysis" was not recorded :-(  While it's possible
   that this is the same bug from some common version of make,
   in the absence of other information we should probably
   keep these two split.
 CHANGE> [Christey changed vote from NOOP to REVIEWING]
 CHANGE> [Christey changed vote from REVIEWING to REJECT]
 Christey> Taking a fresh look at the diff's for FreeBSD make:
   ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:01.make.asc
   And Debian make:
   http://security.debian.org/dists/slink/updates/source/make_3.77-5slink.diff.gz
   
   OK... now that I've hurt my brain looking at the code, while
   there are major differences in the surrounding code,
   ultimately both FreeBSD and Debian create an "outfile" file
   descriptor for the temporary file, within main() in main.c.
   In addition, child_execute_job() in job.c uses an outfile
   variable - for both sources.
   
   Perhaps FreeBSD reported the -j problem without seeing that it
   could come in from stdin as well, and/or Debian/etc. didn't realize
   that it was exploitable from job control, or maybe a combination of
   the two.  Regardless, the two problems are the same.
   
   Phew!  There goes a half-hour of my life that I'll never be
   able to get back...