Skip to Content.
Sympa Menu

sm-sorcery-bugs - [SM-Sorcery-Bugs] [Bug 7529] New: [security] insecure tmp file handling vulnerability (mk_temp_dirs)

sm-sorcery-bugs AT lists.ibiblio.org

Subject: Bugs for Sorcery are reported here

List archive

Chronological Thread  
  • From: bugzilla-daemon AT metalab.unc.edu
  • To: sm-sorcery-bugs AT lists.ibiblio.org
  • Subject: [SM-Sorcery-Bugs] [Bug 7529] New: [security] insecure tmp file handling vulnerability (mk_temp_dirs)
  • Date: Sat, 16 Oct 2004 18:40:22 -0400

http://bugs.sourcemage.org/show_bug.cgi?id=7529

Summary: [security] insecure tmp file handling vulnerability
(mk_temp_dirs)
Product: Sorcery
Version: Test
Platform: Other
OS/Version: other
Status: NEW
Severity: major
Priority: P1
Component: Cast
AssignedTo: sm-sorcery-bugs AT lists.ibiblio.org
ReportedBy: cykl AT madchat.org
CC: wandre.l AT free.fr


Overview :
---------

There is a race condition in cast which allow an attacker to write in any
file.
This flaw is due to a wrong check in handling tmp files.

Details :
--------

$ sorcery --version
20041015

vim =cast
1050 function mk_tmp_dirs() {
1051 debug "$FUNCNAME" "Making tmp dirs for $$"
1052 # in order for TMP_DIR to make it through make and into
pass_three/four
1053 # we must export
1054 export TMP_DIR=/tmp/sorcery/cast/$$
1055 if [ -d $TMP_DIR ] ; then
1056 echo "Looks like you had an old cast on PID $$. I'm cleaning it
out."
1057 rm -rf $TMP_DIR
1058 fi
1059 mkdir -p $TMP_DIR
1060 }

What is wrong with this function ? When cast is called for the first time (or
maybe for another reason like a cron job) /tmp/sorcery may not exist. This
allow an attacker to create a *file* named /tmp/sorcery/cast/$$. So the test
will not detect that mkdir call will fail. Since the return value of mkdir is
not
checked no error will be detected !

Now, if we can change /tmp/sorcery/cast/$$ into a directory at the right time
we can create a symlink like Makefile -> /etc/shadow. Any file in the system
can be overwritten.

This vulnerability can theorically be exploited but exploits are difficult to
write
since it is quite hard to know when the file should be changed into a
directory. I have not be able to write a proof of concept :-)

Patch :
-----

use -x instead of -d and check the mkdir's return value.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.



  • [SM-Sorcery-Bugs] [Bug 7529] New: [security] insecure tmp file handling vulnerability (mk_temp_dirs), bugzilla-daemon, 10/16/2004

Archive powered by MHonArc 2.6.24.

Top of Page