FreeBSD Security Advisory: FreeBSD-SA-01:13.sort

FreeBSD Security Advisories security-advisories at
Mon Jan 29 13:20:06 PST 2001


FreeBSD-SA-01:13                                           Security Advisory
                                                                FreeBSD, Inc.

Topic:          sort uses insecure temporary files

Category:       core
Module:         sort
Announced:      2001-01-29
Credits:        Discovered during internal auditing
Affects:        FreeBSD 3.x (all releases), FreeBSD 4.x (all releases
                prior to 4.2), FreeBSD 3.5-STABLE prior to the
                correction date.
Corrected:      2000-11-11 (FreeBSD 4.1.1-STABLE)
                2001-01-01 (FreeBSD 3.5-STABLE)
FreeBSD only:   NO

I.   Background

sort(1) is a program to sort lines of text.  It is externally
maintained, contributed software which is included in FreeBSD by

II.  Problem Description

During internal auditing, sort(1) was found to use easily predictable
temporary file names.  It does create these temporary files correctly
such that they cannot be "subverted" by a symlink attack, but the
program will abort if the temporary filename chosen is already in use.
This allows an attacker to cause the sort(1) command to abort, which
may have a cascade effect on other scripts which make use of it (such
as system management and reporting scripts).  For example, it may be
possible to use this failure mode to hide the reporting of malicious
system activity which would otherwise be detected by a management

All released versions of FreeBSD prior to the correction date including
FreeBSD 3.5.1 and FreeBSD 4.1.1 are vulnerable.  The problem was
corrected prior to the release of FreeBSD 4.2.

III. Impact

Attackers can cause the operation of sort(1) to fail, possibly
disrupting aspects of system operation.

IV.  Workaround

None appropriate.

V.   Solution

One of the following:

Upgrade the vulnerable FreeBSD system to FreeBSD 3.5-STABLE,
4.2-RELEASE, or 4.2-STABLE after the correction date.

To patch your present system: download the relevant patch from the
below location, and execute the following commands as root:

[FreeBSD 4.1.1 base system]

# fetch
# fetch

Verify the detached PGP signature using your PGP utility.

# cd /usr/src/gnu/usr.bin/sort
# patch -p < /path/to/patch
# make depend && make all install

[FreeBSD 3.5.1 base system]

# fetch
# fetch

Verify the detached PGP signature using your PGP utility.

# cd /usr/src/gnu/usr.bin/sort
# patch -p < /path/to/patch
# make depend && make all install

Version: GnuPG v1.0.4 (FreeBSD)
Comment: For info see


This is the moderated mailing list freebsd-announce.
The list contains announcements of new FreeBSD capabilities,
important events and project milestones.
See also the FreeBSD Web pages at

To Unsubscribe: send mail to majordomo at
with "unsubscribe freebsd-announce" in the body of the message

More information about the freebsd-announce mailing list