Security bugs are reported here via bugzilla

[bugzilla-daemon AT metalab.unc.edu]

http://bugs.sourcemage.org/show_bug.cgi?id=7530

           Summary: [sorcery/installwatch] insecure tmp file handling
                    vulnerability
           Product: Security
           Version: unspecified
          Platform: Other
        OS/Version: other
            Status: NEW
          Severity: critical
          Priority: P1
         Component: Security Issue
        AssignedTo: sm-security AT lists.ibiblio.org
        ReportedBy: cykl AT madchat.org
                CC: wandre.l AT free.fr


Overview : 
---------

An insecure tmp file handling vulnerability can allow an attacker to write in
any file.

Details :
--------

$ sorcery --version
20041015

vim =cast
    708   IW_LOG="/tmp/$SPELL.iw"

vim /var/lib/sorcery/modules/libtrack
     50 function invoke_installwatch()  {
     51 
     52   if  [  -e  /usr/lib/installwatch.so  ];  then
     53     export  INSTALLWATCHFILE=$IW_LOG
     54     export  LD_PRELOAD=/usr/lib/installwatch.so
     55   fi
     56 
     57 }

vim installwatch.c
    147         if((logname = getenv("INSTALLWATCHFILE"))) {
    148                 logfd = true_open(logname, O_WRONLY | O_CREAT | 
O_APPEND
       , 0666);

As you can see, the name of the installwatch's file is fully deterministic.
Nor sorcery nor install check if the tmp file already exist, this allow an
attacker to create a symlink to write in any file.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.