CVE-2010-1160

Description

GNU nano before 2.2.4 does not verify whether a file has been changed before it is overwritten in a file-save operation, which allows local user-assisted attackers to overwrite arbitrary files via a symlink attack on an attacker-owned file that is being edited by the victim.

Affected products

• gnu / nano2.2.3
• gnu / nano0.5.0 – 0.5.0
• gnu / nano0.5.1 – 0.5.1
• gnu / nano0.5.2 – 0.5.2
• gnu / nano0.5.3 – 0.5.3
• gnu / nano0.5.4 – 0.5.4
• gnu / nano0.5.5 – 0.5.5
• gnu / nano0.6.0 – 0.6.0
• gnu / nano0.6.1 – 0.6.1
• gnu / nano0.6.2 – 0.6.2
• gnu / nano0.6.3 – 0.6.3
• gnu / nano0.6.4 – 0.6.4
• gnu / nano0.6.5 – 0.6.5
• gnu / nano0.6.6 – 0.6.6
• gnu / nano0.6.7 – 0.6.7
• gnu / nano0.6.8 – 0.6.8
• gnu / nano0.6.9 – 0.6.9
• gnu / nano0.7.0 – 0.7.0
• gnu / nano0.7.1 – 0.7.1
• gnu / nano0.7.2 – 0.7.2
• gnu / nano0.7.3 – 0.7.3
• gnu / nano0.7.4 – 0.7.4
• gnu / nano0.7.5 – 0.7.5
• gnu / nano0.7.6 – 0.7.6
• gnu / nano0.7.7 – 0.7.7
• gnu / nano0.7.8 – 0.7.8
• gnu / nano0.7.9 – 0.7.9
• gnu / nano0.8.0 – 0.8.0
• gnu / nano0.8.1 – 0.8.1
• gnu / nano0.8.2 – 0.8.2
• gnu / nano0.8.3 – 0.8.3
• gnu / nano0.8.4 – 0.8.4
• gnu / nano0.8.5 – 0.8.5
• gnu / nano0.8.6 – 0.8.6
• gnu / nano0.8.7 – 0.8.7
• gnu / nano0.8.8 – 0.8.8
• gnu / nano0.8.9 – 0.8.9
• gnu / nano0.9.0 – 0.9.0
• gnu / nano0.9.1 – 0.9.1
• gnu / nano0.9.2 – 0.9.2
• gnu / nano0.9.3 – 0.9.3
• gnu / nano0.9.4 – 0.9.4
• gnu / nano0.9.5 – 0.9.5
• gnu / nano0.9.6 – 0.9.6
• gnu / nano0.9.7 – 0.9.7
• gnu / nano0.9.8 – 0.9.8
• gnu / nano0.9.9 – 0.9.9
• gnu / nano0.9.10 – 0.9.10
• gnu / nano0.9.11 – 0.9.11
• gnu / nano0.9.12 – 0.9.12
• gnu / nano0.9.13 – 0.9.13
• gnu / nano0.9.14 – 0.9.14
• gnu / nano0.9.15 – 0.9.15
• gnu / nano0.9.16 – 0.9.16
• gnu / nano0.9.17 – 0.9.17
• gnu / nano0.9.18 – 0.9.18
• gnu / nano0.9.19 – 0.9.19
• gnu / nano0.9.20 – 0.9.20
• gnu / nano0.9.21 – 0.9.21
• gnu / nano0.9.22 – 0.9.22
• gnu / nano0.9.23 – 0.9.23
• gnu / nano0.9.24 – 0.9.24
• gnu / nano0.9.25 – 0.9.25
• gnu / nano0.9.99pre1 – 0.9.99pre1
• gnu / nano0.9.99pre2 – 0.9.99pre2
• gnu / nano0.9.99pre3 – 0.9.99pre3
• gnu / nano1.0.0 – 1.0.0
• gnu / nano1.0.1 – 1.0.1
• gnu / nano1.0.2 – 1.0.2
• gnu / nano1.0.3 – 1.0.3
• gnu / nano1.0.4 – 1.0.4
• gnu / nano1.0.5 – 1.0.5
• gnu / nano1.0.6 – 1.0.6
• gnu / nano1.0.7 – 1.0.7
• gnu / nano1.0.8 – 1.0.8
• gnu / nano1.0.9 – 1.0.9
• gnu / nano1.1.0 – 1.1.0
• gnu / nano1.1.1 – 1.1.1
• gnu / nano1.1.2 – 1.1.2
• gnu / nano1.1.3 – 1.1.3
• gnu / nano1.1.4 – 1.1.4
• gnu / nano1.1.5 – 1.1.5
• gnu / nano1.1.6 – 1.1.6
• gnu / nano1.1.7 – 1.1.7
• gnu / nano1.1.8 – 1.1.8
• gnu / nano1.1.9 – 1.1.9
• gnu / nano1.1.10 – 1.1.10
• gnu / nano1.1.11 – 1.1.11
• gnu / nano1.1.12 – 1.1.12
• gnu / nano1.1.99pre1 – 1.1.99pre1
• gnu / nano1.1.99pre2 – 1.1.99pre2
• gnu / nano1.1.99pre3 – 1.1.99pre3
• gnu / nano1.2.0 – 1.2.0
• gnu / nano1.2.1 – 1.2.1
• gnu / nano1.2.2 – 1.2.2
• gnu / nano1.2.3 – 1.2.3
• gnu / nano1.2.4 – 1.2.4
• gnu / nano1.2.5 – 1.2.5
• gnu / nano1.3.0 – 1.3.0
• gnu / nano1.3.1 – 1.3.1
• gnu / nano1.3.2 – 1.3.2
• gnu / nano1.3.3 – 1.3.3
• gnu / nano1.3.4 – 1.3.4
• gnu / nano1.3.5 – 1.3.5
• gnu / nano1.3.6 – 1.3.6
• gnu / nano1.3.7 – 1.3.7
• gnu / nano1.3.8 – 1.3.8
• gnu / nano1.3.9 – 1.3.9
• gnu / nano1.3.10 – 1.3.10
• gnu / nano1.3.11 – 1.3.11
• gnu / nano1.3.12 – 1.3.12
• gnu / nano1.9.99pre1 – 1.9.99pre1
• gnu / nano1.9.99pre2 – 1.9.99pre2
• gnu / nano1.9.99pre3 – 1.9.99pre3
• gnu / nano2.0.0 – 2.0.0
• gnu / nano2.0.1 – 2.0.1
• gnu / nano2.0.2 – 2.0.2
• gnu / nano2.0.3 – 2.0.3
• gnu / nano2.0.4 – 2.0.4
• gnu / nano2.0.5 – 2.0.5
• gnu / nano2.0.6 – 2.0.6
• gnu / nano2.0.7 – 2.0.7
• gnu / nano2.0.8 – 2.0.8
• gnu / nano2.0.9 – 2.0.9
• gnu / nano2.1.0 – 2.1.0
• gnu / nano2.1.1 – 2.1.1
• gnu / nano2.1.2 – 2.1.2
• gnu / nano2.1.3 – 2.1.3
• gnu / nano2.1.4 – 2.1.4
• gnu / nano2.1.5 – 2.1.5
• gnu / nano2.1.6 – 2.1.6
• gnu / nano2.1.7 – 2.1.7
• gnu / nano2.1.8 – 2.1.8
• gnu / nano2.1.9 – 2.1.9
• gnu / nano2.1.10 – 2.1.10
• gnu / nano2.1.11 – 2.1.11
• gnu / nano2.1.99pre1 – 2.1.99pre1
• gnu / nano2.1.99pre2 – 2.1.99pre2
• gnu / nano2.2.0 – 2.2.0
• gnu / nano2.2.1 – 2.2.1
• gnu / nano2.2.2 – 2.2.2

References

• MAILING_LISThttp://lists.gnu.org/archive/html/nano-devel/2010-04/msg00000.html
• MISChttp://svn.savannah.gnu.org/viewvc/trunk/nano/ChangeLog?revision=4503&root=nano&view=markup
• MAILING_LISThttp://www.openwall.com/lists/oss-security/2010/04/14/4
• MISChttp://www.securitytracker.com/id?1023891
• MISChttp://drosenbe.blogspot.com/2010/03/nano-as-root.html
• VENDOR_ADVISORYhttp://secunia.com/advisories/39444