ez-ipupdate 3.0.11b7 and earlier creates insecure temporary cache files, which allows local users to conduct unauthorized operations via a symlink attack on the ez-ipupdate.cache file.
ez-ipupdate versions 3.0.11b7 and earlier are vulnerable to a symlink attack, allowing local users to potentially overwrite the ez-ipupdate.cache file. This can lead to unauthorized modification of the dynamic DNS configuration, potentially enabling DNS hijacking or other malicious activities, impacting system availability and data integrity.
Step 1: Target Identification: The attacker identifies a system running a vulnerable version of ez-ipupdate.
Step 2: Symlink Creation: The attacker creates a symbolic link (symlink) named ez-ipupdate.cache that points to a target file they wish to overwrite (e.g., /etc/passwd).
Step 3: Race Condition Trigger: The attacker attempts to trigger ez-ipupdate to write to the ez-ipupdate.cache file. This can be achieved by waiting for the automatic update interval or by manually running the ez-ipupdate command.
Step 4: File Overwrite: When ez-ipupdate attempts to write to ez-ipupdate.cache, it actually writes to the target file pointed to by the symlink. This overwrites the contents of the target file.
Step 5: Privilege Escalation/System Compromise: Depending on the target file, the attacker can achieve privilege escalation (e.g., by modifying /etc/passwd to add a new user with root privileges) or other forms of system compromise.
The vulnerability stems from the insecure creation of temporary cache files by ez-ipupdate. The software uses a predictable filename, ez-ipupdate.cache, and does not properly validate the file's ownership or permissions before writing to it. This creates a race condition where a local attacker can exploit a symlink to point the ez-ipupdate.cache file to a critical system file (e.g., /etc/passwd, /etc/shadow, or a configuration file). The attacker then triggers ez-ipupdate to write to the symlinked file, leading to unauthorized modification. The root cause is a failure to implement secure file handling practices, specifically the lack of proper input validation and secure file creation flags.