Skip to Content.
Sympa Menu

sm-sorcery-bugs - [SM-Sorcery-Bugs] [Bug 7528] New: [security] : insecure tmp file handling vulnerability ($F_TMP)

sm-sorcery-bugs AT lists.ibiblio.org

Subject: Bugs for Sorcery are reported here

List archive

Chronological Thread  
  • From: bugzilla-daemon AT metalab.unc.edu
  • To: sm-sorcery-bugs AT lists.ibiblio.org
  • Subject: [SM-Sorcery-Bugs] [Bug 7528] New: [security] : insecure tmp file handling vulnerability ($F_TMP)
  • Date: Sat, 16 Oct 2004 22:39:29 -0400

http://bugs.sourcemage.org/show_bug.cgi?id=7528

Summary: [security] : insecure tmp file handling vulnerability
($F_TMP)
Product: Sorcery
Version: Test
Platform: Other
OS/Version: other
Status: RESOLVED
Severity: minor
Priority: P4
Component: Cast
AssignedTo: sm-sorcery-bugs AT lists.ibiblio.org
ReportedBy: cykl AT madchat.org
CC: wandre.l AT free.fr


Overview :
---------

An insecure tmp file handling vulnerability in cast can allow an attacker to
write in any file.

Details :
--------

$ sorcery --version
20041015

234 function remove_line() {
235
236 F_TMP=/tmp/`basename $I_LOG`.$$.$RANDOM
237
238 cp "$I_LOG" "$F_TMP"

What is wrong ?

-> `basename $I_LOG` is easily predictable

-> $$ is easily predictable (with something like 1000..10000 try)

-> $RANDOM provide a number between 0 and 32767.

An attacker can created several thousand of symlinks which match the pattern
to
be able override any file. With a bit of luck and a lot of inodes it is pretty
easy to exploit.

Patch :
-----

Check if $F_TMP does not exist before to do the cp.

------- Additional Comments From acedit AT armory.com 2004-10-16 22:39 -------
remove_line is only called from cast --fix, which of course is depreciated,
and will be removed in the 1.12 sorcery release.

Also I fail to see how this is even remotely exploitable, we copy the
install log to a file in /tmp, thus overwriting whatever the attacker
has in it, then they get about 1/4 of a second to put something dirty in it,
and then it gets put back in as the install log. I guess then the attacker
hopes to know when the attacked spell will be dispelled, and thus can get
some files removed?

This seems like a pretty contrived example of a security flaw to be called
a P1/Crit and need fixing in the test sorcery timeframe...resolving
as wontfix.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.




Archive powered by MHonArc 2.6.24.

Top of Page