FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

imwheel -- insecure handling of PID file

Affected packages
imwheel < 1.0.0.p12

Details

VuXML ID e31d44a2-21e3-11d9-9289-000c41e2cdad
Discovery 2004-08-20
Entry 2004-10-19

A Computer Academic Underground advisory describes the consequences of imwheel's handling of the process ID file (PID file):

imwheel exclusively uses a predictably named PID file for management of multiple imwheel processes. A race condition exists when the -k command-line option is used to kill existing imwheel processes. This race condition may be used by a local user to Denial of Service another user using imwheel, lead to resource exhaustion of the host system, or append data to arbitrary files.

References

URL http://imwheel.sourceforge.net/files/DEVELOPMENT.txt
URL http://www.caughq.org/advisories/CAU-2004-0002.txt