Skip to Content.
Sympa Menu

sm-security - [SM-Security] [Bug 7530] New: [sorcery/installwatch] insecure tmp file handling vulnerability

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: bugzilla-daemon AT metalab.unc.edu
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] [Bug 7530] New: [sorcery/installwatch] insecure tmp file handling vulnerability
  • Date: Sat, 16 Oct 2004 18:44:21 -0400

http://bugs.sourcemage.org/show_bug.cgi?id=7530

Summary: [sorcery/installwatch] insecure tmp file handling
vulnerability
Product: Security
Version: unspecified
Platform: Other
OS/Version: other
Status: NEW
Severity: critical
Priority: P1
Component: Security Issue
AssignedTo: sm-security AT lists.ibiblio.org
ReportedBy: cykl AT madchat.org
CC: wandre.l AT free.fr


Overview :
---------

An insecure tmp file handling vulnerability can allow an attacker to write in
any file.

Details :
--------

$ sorcery --version
20041015

vim =cast
708 IW_LOG="/tmp/$SPELL.iw"

vim /var/lib/sorcery/modules/libtrack
50 function invoke_installwatch() {
51
52 if [ -e /usr/lib/installwatch.so ]; then
53 export INSTALLWATCHFILE=$IW_LOG
54 export LD_PRELOAD=/usr/lib/installwatch.so
55 fi
56
57 }

vim installwatch.c
147 if((logname = getenv("INSTALLWATCHFILE"))) {
148 logfd = true_open(logname, O_WRONLY | O_CREAT |
O_APPEND
, 0666);

As you can see, the name of the installwatch's file is fully deterministic.
Nor sorcery nor install check if the tmp file already exist, this allow an
attacker to create a symlink to write in any file.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.



  • [SM-Security] [Bug 7530] New: [sorcery/installwatch] insecure tmp file handling vulnerability, bugzilla-daemon, 10/16/2004

Archive powered by MHonArc 2.6.24.

Top of Page