Cloudanix VulnDB

CVE-2009-4135

None

CVSS

—

EPSS

0.4%

Published

Dec 11, 2009

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

An old flaw in basic system tools let nearby users trick the software with shortcut files in temporary folders to gain more access than they should have.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
Application
Class
Path Traversal
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The distcheck rule in dist-check.mk follows symlinks without validation when operating on files under /tmp, enabling local users to redirect operations to arbitrary filesystem locations and escalate privileges.

Why it matters to the business

Local attackers on unpatched systems can obtain elevated access, potentially compromising system integrity and allowing further attacks; the vulnerability affects legacy deployments of core system utilities but carries low urgency today due to its age and limited exploitability.

How an attack unfolds

A local attacker identifies a directory tree under /tmp used by the distcheck rule, plants crafted symlinks pointing to privileged targets, and triggers the rule so that operations follow the links and grant unauthorized access.

How to fix it

Upgrade GNU coreutils to a version newer than 8.1 on all affected platforms; remove or disable the dist-check.mk rule if upgrades are not feasible.

How to confirm the fix worked

Confirm coreutils version exceeds 8.1, review dist-check.mk for symlink handling changes, and test rule execution against symlink trees in /tmp to verify safe behavior.

Typical attack path

  1. Obtain local unprivileged access to a target system
  2. Locate or create a writable directory tree under /tmp that will be processed by dist-check.mk
  3. Create malicious symlinks within that tree pointing to sensitive files or directories
  4. Trigger execution of the vulnerable distcheck rule
  5. Perform operations that follow the symlinks to achieve privilege escalation

How to detect it

Examine system and audit logs for coreutils processes creating or following unexpected symlinks in /tmp; correlate with build or packaging job timestamps and inspect for privilege changes around those events.

What your security team should do

  • Prioritize upgrade of GNU coreutils packages on any remaining legacy systems
  • Audit build and packaging scripts that invoke dist-check.mk
  • Apply least-privilege restrictions on /tmp directories and monitor for anomalous symlink activity
  • Remove or replace legacy coreutils components where modern alternatives exist

The record

The distcheck rule in dist-check.mk in GNU coreutils 5.2.1 through 8.1 allows local users to gain privileges via a symlink attack on a file in a directory tree under /tmp.

Affected packages

Ecosystem Package Introduced Fixed
Ubuntu:14.04:LTS coreutils 0 8.21-1ubuntu5.1

Related vulnerabilities