[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20090610212311.4d3ccd77@redhat.com>
Date: Wed, 10 Jun 2009 21:23:11 +0200
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Cc: krahmer@...e.de
Subject: Re: xfig-3.2.5 diff (CVE-2009-1962)
Hi Sebastian!
On Mon, 8 Jun 2009 12:49:48 +0200 Sebastian Krahmer <krahmer@...e.de>
wrote:
> just in case you need it, our maintainer asked me to forward
> a patch for $SUBJECT which has been fixed in our xfig
> for quite some time.
Looks like the patch you attached does not differ much from what we use
for some time too and seems to have an origin here:
https://bugzilla.redhat.com/show_bug.cgi?id=67351
And it does not differ much from what Nico previously posted:
http://thread.gmane.org/gmane.comp.security.oss.general/1609
However, Nico's patch, probably taken from Fedora XFig packages, has
one hunk missing for:
u_print.c: sprintf(tmp_fig_file, "%s/%s%06d", TMPDIR, "xfig-fig", getpid());
that seem to have been lost during 3.2.4 -> 3.2.5 patch
forward-porting. This code is reached e.g. when you select File ->
Print -> Print figure to batch.
I've also grepped source for other obvious TMPDIR uses and here's my
list:
d_text.c: sprintf(preedit_filename, "%s/%s%06d", TMPDIR, "xfig-preedit", getpid());
- This code if #ifdef I18N_USE_PREEDIT, though I do not see
I18N_USE_PREEDIT defined anywhere. Does not seem to be used in our
builds.
f_util.c: sprintf(tmpfile, "%s%s", TMPDIR, c);
f_util.c: sprintf(tmpfile, "%s/%s", TMPDIR, plainname);
- This can be triggered if user tries to open zipped file in some
directory where she can not write (it is used as "gunzip -c >
tmpfile"). Warning is printed when TMPDIR is used, but it's still
possible to perform symlink attack when victim can be tricked to open
some attacker chosen file.
u_error.c: if (emergency_save(strcat(TMPDIR,"/SAVE.fig")) == -1)
- This is emergency auto-save feature, executed when xfig is signaled
or detect some X error. Current directory is tried first, TMPDIR is
fallback when current directory fails.
The latter two are not really temp files, so mkstemp may not be the
right fix here.
--
Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
