English version →
ログイン 新規登録
JA · EN · FR
SecPulse
カテゴリ
CVE-2020-27216

Local Temp Directory Hijacking Vulnerability

概要

Local Temp Directory Hijacking Vulnerability

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Impact

On Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.

Additionally, any user code uses of WebAppContext::getTempDirectory would similarly be vulnerable.

Additionally, any user application code using the ServletContext attribute for the tempdir will also be impacted.
See: https://javaee.github.io/javaee-spec/javadocs/javax/servlet/ServletContext.html#TEMPDIR

For example:

import java.io.File;
import java.io.IOException;
import javax.servlet.ServletContext;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class ExampleServlet extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        File t…

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

影響パッケージ

Maven org.eclipse.jetty:jetty-webapp
[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0.beta1"},{"fixed":"11.0.0.beta3"}]}]
Maven org.mortbay.jetty:jetty-webapp
[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0.beta1"},{"fixed":"11.0.0.beta3"}]}]

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

参照URL

当サイトでは、アクセス解析と広告の効果測定のために Cookie を使います。株式会社Game のサイト共通の設定です。 詳しく