sm-sorcery-bugs AT lists.ibiblio.org
Subject: Bugs for Sorcery are reported here
List archive
[SM-Sorcery-Bugs] [Bug 7528] New: [security] : insecure tmp file handling vulnerability ($F_TMP)
- From: bugzilla-daemon AT metalab.unc.edu
- To: sm-sorcery-bugs AT lists.ibiblio.org
- Subject: [SM-Sorcery-Bugs] [Bug 7528] New: [security] : insecure tmp file handling vulnerability ($F_TMP)
- Date: Sat, 16 Oct 2004 18:35:02 -0400
http://bugs.sourcemage.org/show_bug.cgi?id=7528
Summary: [security] : insecure tmp file handling vulnerability
($F_TMP)
Product: Sorcery
Version: Test
Platform: Other
OS/Version: other
Status: NEW
Severity: major
Priority: P1
Component: Cast
AssignedTo: sm-sorcery-bugs AT lists.ibiblio.org
ReportedBy: cykl AT madchat.org
CC: wandre.l AT free.fr
Overview :
---------
An insecure tmp file handling vulnerability in cast can allow an attacker to
write in any file.
Details :
--------
$ sorcery --version
20041015
234 function remove_line() {
235
236 F_TMP=/tmp/`basename $I_LOG`.$$.$RANDOM
237
238 cp "$I_LOG" "$F_TMP"
What is wrong ?
-> `basename $I_LOG` is easily predictable
-> $$ is easily predictable (with something like 1000..10000 try)
-> $RANDOM provide a number between 0 and 32767.
An attacker can created several thousand of symlinks which match the pattern
to
be able override any file. With a bit of luck and a lot of inodes it is pretty
easy to exploit.
Patch :
-----
Check if $F_TMP does not exist before to do the cp.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
-
[SM-Sorcery-Bugs] [Bug 7528] New: [security] : insecure tmp file handling vulnerability ($F_TMP),
bugzilla-daemon, 10/16/2004
- <Possible follow-up(s)>
- [SM-Sorcery-Bugs] [Bug 7528] New: [security] : insecure tmp file handling vulnerability ($F_TMP), bugzilla-daemon, 10/16/2004
Archive powered by MHonArc 2.6.24.