CVE-2014-1936
📋 TL;DR
CVE-2014-1936 is a vulnerability in rc (run commands) software where temporary files are created insecurely, allowing local attackers to perform symlink attacks. This affects systems using rc versions before 1.7.1-5. The vulnerability enables file manipulation and potential privilege escalation.
💻 Affected Systems
- rc (run commands)
📦 What is this software?
Rc by Rc Project
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to root, allowing complete system compromise through symlink attacks on temporary files.
Likely Case
Local user gains unauthorized write access to sensitive files, potentially leading to data corruption or limited privilege escalation.
If Mitigated
Minimal impact with proper file permissions and SELinux/AppArmor restrictions preventing symlink attacks.
🎯 Exploit Status
Exploitation requires local shell access and knowledge of rc usage patterns. Symlink attacks are well-understood techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.1-5 and later
Vendor Advisory: https://security-tracker.debian.org/tracker/CVE-2014-1936
Restart Required: No
Instructions:
1. Update rc package: sudo apt-get update && sudo apt-get install rc
2. Verify version: rc --version
3. Ensure version is 1.7.1-5 or higher
🔧 Temporary Workarounds
Remove rc package
linuxUninstall rc if not required for system functionality
sudo apt-get remove rc
Restrict file permissions
linuxSet strict permissions on directories where rc creates temporary files
sudo chmod 700 /tmp/rc*
sudo chown root:root /tmp/rc*
🧯 If You Can't Patch
- Remove or disable rc if not essential for operations
- Implement strict file system monitoring and integrity checking for temporary file creation
🔍 How to Verify
Check if Vulnerable:
Check rc version: dpkg -l | grep rc or rpm -qa | grep rcCheck Version:
rc --version || dpkg -l | grep rc || rpm -qa | grep rcVerify Fix Applied:
Verify installed version is 1.7.1-5 or higher: rc --version📡 Detection & Monitoring
Log Indicators:
- Unusual temporary file creation patterns
- Symlink creation in /tmp directories
- Failed file permission operations
Network Indicators:
- None - local vulnerability only
SIEM Query:
process.name:rc AND file.path:/tmp/* AND (file.action:create OR file.action:modify)🔗 References
- http://www.openwall.com/lists/oss-security/2014/02/11/1
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737125
- https://security-tracker.debian.org/tracker/CVE-2014-1936
- http://www.openwall.com/lists/oss-security/2014/02/11/1
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737125
- https://security-tracker.debian.org/tracker/CVE-2014-1936
