sm-sorcery-bugs AT lists.ibiblio.org
Subject: Bugs for Sorcery are reported here
List archive
[SM-Sorcery-Bugs] [Bug 7528] New: [security] : insecure tmp file handling vulnerability ($F_TMP)
- From: bugzilla-daemon AT metalab.unc.edu
- To: sm-sorcery-bugs AT lists.ibiblio.org
- Subject: [SM-Sorcery-Bugs] [Bug 7528] New: [security] : insecure tmp file handling vulnerability ($F_TMP)
- Date: Sat, 16 Oct 2004 22:39:29 -0400
http://bugs.sourcemage.org/show_bug.cgi?id=7528
Summary: [security] : insecure tmp file handling vulnerability
($F_TMP)
Product: Sorcery
Version: Test
Platform: Other
OS/Version: other
Status: RESOLVED
Severity: minor
Priority: P4
Component: Cast
AssignedTo: sm-sorcery-bugs AT lists.ibiblio.org
ReportedBy: cykl AT madchat.org
CC: wandre.l AT free.fr
Overview :
---------
An insecure tmp file handling vulnerability in cast can allow an attacker to
write in any file.
Details :
--------
$ sorcery --version
20041015
234 function remove_line() {
235
236 F_TMP=/tmp/`basename $I_LOG`.$$.$RANDOM
237
238 cp "$I_LOG" "$F_TMP"
What is wrong ?
-> `basename $I_LOG` is easily predictable
-> $$ is easily predictable (with something like 1000..10000 try)
-> $RANDOM provide a number between 0 and 32767.
An attacker can created several thousand of symlinks which match the pattern
to
be able override any file. With a bit of luck and a lot of inodes it is pretty
easy to exploit.
Patch :
-----
Check if $F_TMP does not exist before to do the cp.
------- Additional Comments From acedit AT armory.com 2004-10-16 22:39 -------
remove_line is only called from cast --fix, which of course is depreciated,
and will be removed in the 1.12 sorcery release.
Also I fail to see how this is even remotely exploitable, we copy the
install log to a file in /tmp, thus overwriting whatever the attacker
has in it, then they get about 1/4 of a second to put something dirty in it,
and then it gets put back in as the install log. I guess then the attacker
hopes to know when the attacked spell will be dispelled, and thus can get
some files removed?
This seems like a pretty contrived example of a security flaw to be called
a P1/Crit and need fixing in the test sorcery timeframe...resolving
as wontfix.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
-
[SM-Sorcery-Bugs] [Bug 7528] New: [security] : insecure tmp file handling vulnerability ($F_TMP),
bugzilla-daemon, 10/16/2004
- <Possible follow-up(s)>
- [SM-Sorcery-Bugs] [Bug 7528] New: [security] : insecure tmp file handling vulnerability ($F_TMP), bugzilla-daemon, 10/16/2004
Archive powered by MHonArc 2.6.24.