[UNIX] GIPTables Firewall Race Condition

GIPTables Firewall Race Condition
------------------------------------------------------------------------

SUMMARY

GIPTables Firewall is a free set of shell
scripts that helps you generate iptables rules for Linux 2.4.x and newer
kernels. It is very easy to configure and at present, designed to run on
hosts with one or two network cards. It doesn't require you to install any
additional components to make it work with your GNU/Linux system. All you
need to set-up a very secure firewall for your GNU/Linux machines is
iptables and GIPTables Firewall."

GIPTables Firewall does not use a random naming convention for its
temporary file creation, this allows attackers to cause a race condition
vulnerability.

DETAILS

Vulnerable Systems:
* GIPTables Firewall version 1.1 and prior

The vulnerability is caused due to temporary file being created
insecurely. This can be exploited via symbolic link to create and
overwrite arbitrary files with the privileges of the user running the
affected script.

It is also possible to cause a denial of service by manipulating the IP
addresses present inside the temporary file

The exploitation require that the root configure or reconfigure his
firewall rules.

Code Snips:
# Network Ghouls

[ "$NETWORK_GHOULS" == "yes" ] && [ "$DEBUG" = "on" ] && echo -e "\n# Network Ghouls"

if [ "$NETWORK_GHOULS" == "yes" ] && [ -f
"$GIPTABLES_BLOCKED_FILE" ]; then

deny_file="$GIPTABLES_BLOCKED_FILE"
temp_file="/tmp/temp.ip.addresses"
cat $deny_file | sed -n -e "s/^[ ]*\([0-9.]*\).*$/\1/p" | awk '
$1 ' > $temp_file
while read ip_addr
do

drop_ipaddr interface0_in source $ip_addr && drop_ipaddr interface0_out destination $ip_addr

[ -n "$INTERFACE1" ] && drop_ipaddr interface1_in source $ip_addr && drop_ipaddr interface1_out destination $ip_addr

[ -n "$INTERFACE1" ] && drop_ipaddr network1_in source $ip_addr && drop_ipaddr network1_out destination $ip_addr

done < $temp_file
rm -f $temp_file > /dev/null 2>&1
unset temp_file
unset deny_file

fi