Skip to Content.
Sympa Menu

sm-sorcery-bugs - [SM-Sorcery-Bugs] [Bug 7528] New: [security] : insecure tmp file handling vulnerability ($F_TMP)

sm-sorcery-bugs AT lists.ibiblio.org

Subject: Bugs for Sorcery are reported here

List archive

Chronological Thread  
  • From: bugzilla-daemon AT metalab.unc.edu
  • To: sm-sorcery-bugs AT lists.ibiblio.org
  • Subject: [SM-Sorcery-Bugs] [Bug 7528] New: [security] : insecure tmp file handling vulnerability ($F_TMP)
  • Date: Sat, 16 Oct 2004 18:35:02 -0400

http://bugs.sourcemage.org/show_bug.cgi?id=7528

Summary: [security] : insecure tmp file handling vulnerability
($F_TMP)
Product: Sorcery
Version: Test
Platform: Other
OS/Version: other
Status: NEW
Severity: major
Priority: P1
Component: Cast
AssignedTo: sm-sorcery-bugs AT lists.ibiblio.org
ReportedBy: cykl AT madchat.org
CC: wandre.l AT free.fr


Overview :
---------

An insecure tmp file handling vulnerability in cast can allow an attacker to
write in any file.

Details :
--------

$ sorcery --version
20041015

234 function remove_line() {
235
236 F_TMP=/tmp/`basename $I_LOG`.$$.$RANDOM
237
238 cp "$I_LOG" "$F_TMP"

What is wrong ?

-> `basename $I_LOG` is easily predictable

-> $$ is easily predictable (with something like 1000..10000 try)

-> $RANDOM provide a number between 0 and 32767.

An attacker can created several thousand of symlinks which match the pattern
to
be able override any file. With a bit of luck and a lot of inodes it is pretty
easy to exploit.

Patch :
-----

Check if $F_TMP does not exist before to do the cp.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.




Archive powered by MHonArc 2.6.24.

Top of Page