[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20080514153812.GI28202@ngolde.de>
Date: Wed, 14 May 2008 17:38:12 +0200
From: Nico Golde <oss-security+ml@...lde.de>
To: oss-security@...ts.openwall.com
Subject: vim $TMPDIR directory stat (was: Re: CVE request: Emacs 21 fast-lock-mode arbitrary lips code execution)
Hi Tavis,
* Tavis Ormandy <taviso@....lonestar.org> [2008-05-14 17:03]:
> On Wed, May 14, 2008 at 04:03:34PM +0200, Sven Joachim wrote:
> > On 2008-05-14 15:27 +0200, Nico Golde wrote:
> >
> > > As I am a vim user I might have done something wrong too,
> > > not sure. What I did after installing emacs:
>
> Same here, so out of curiosity i ran strace -efile -o log vim, and
> edited a few files. I observed vim looking for a directory called
> $TMPDIR in the wd, and using it as you would expect. Obviously a bug,
> and perhaps some minor security implications, anyone want to
> investigate? :-)
The reason is:
src/unix.h:
# define TEMPDIRNAMES "$TMPDIR", "/tmp", ".", "$HOME"
on startup vim then expands those paths and checks if the
directory exists (that's where the stat comes from I think).
If it exists it will use it as temporary directory to mkdir
the temporary directory for vim files, v<somenumber>.
src/fileio.c:
6811 for (i = 0; i < sizeof(tempdirs) / sizeof(char *); ++i)
6812 {
6813 /* expand $TMP, leave room for "/v1100000/999999999" */
6814 expand_env((char_u *)tempdirs[i], itmp, TEMPNAMELEN - 20);
6815 printf("expanded %s to %s\n", tempdirs[i], itmp);
6816 if (mch_isdir(itmp)) /* directory exists */
....
6843 sprintf((char *)itmp + STRLEN(itmp), "v%ld", nr + off);
6844 # ifndef EEXIST
6845 /* If mkdir() does not set errno to EEXIST, check for
6846 * existing file here. There is a race condition then,
6847 * although it's fail-safe. */
6848 if (mch_stat((char *)itmp, &st) >= 0)
6849 continue;
6850 # endif
6851 #if defined(UNIX) || defined(VMS)
6852 /* Make sure the umask doesn't remove the executable bit.
6853 * "repl" has been reported to use "177". */
6854 umask_save = umask(077);
6855 #endif
6856 r = vim_mkdir(itmp, 0700);
So it checks for $TMPDIR on your system because this
environment variable is not set and therefore can't be expanded?!
You could redirect the temporary files of a user to a
location the attacker and the victim has access to but vim
still sets the correct permissions so this does not help the
attacker. After a quick check this doesn't look like a
security issue to me.
Kind regards
Nico
--
Nico Golde - http://www.ngolde.de - nion@...ber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
