I was given an assignment for my Computer Security class. We we were given a piece of code to analyze and determine the vulnerabilities that it might have.
#!/bin/sh # shell script to create a copy of the shadow file to the /tmp directory echo > /tmp/shadowcopy # allow only root access chmod 600 /tmp/shadowcopy # append the original file to the copy cat /etc/shadow >> /tmp/shadowcopy # Hint: the access permissions of a file in linux are verified when the file is opened. # the process will keep the original permissions as long as it keeps the file open, even # if permissions change.
Some classmates and I determined that this script might suffer from race condition vulnerability if two separate process try to open the /tmp/shadowcopy.
We also think that command injection vulnerability could be possible if the /tmp/shadowcopy is changed before the append begins.
Are our assumptions about this shell script correct? or are we missing an important vulnerability that might be exploited if the script is used?