oss-security - Re: Fwd: emesene preditable temporary filename

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1495541676.812241275413970335.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Tue, 1 Jun 2010 13:39:30 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: coley <coley@...re.org>
Subject: Re: Fwd: emesene preditable temporary filename

Please use CVE-2010-2053.

Thanks.

-- 
    JB


----- "Emilio Pozuelo Monfort" <pochu@...ian.org> wrote:

> Hi,
> 
> I sent this to vendor-sec but got no response. I've been told to send
> it to
> oss-security, so here it goes.
> 
> The fix is:
> 
> --- emesene-1.6.1/emesenelib/ProfileManager.py	2010-03-29
> 22:27:23.000000000 +0200
> +++ emesene-1.6.2/emesenelib/ProfileManager.py	2010-05-26
> 21:51:32.000000000 +0200
> @@ -208,16 +211,10 @@ class ProfileManager(gobject.GObject):
>              return False
>          data = response.read()
>          #print "DP:", len(data), stat, reas
> -        if os.name == "nt":
> -            tempfolder = os.environ['TEMP'] + os.sep + "emsnpic"
> -            tempfolder = unicode(tempfolder)
> -        else:
> -            tempfolder = '/tmp/emsnpic'
> -        f = open(tempfolder, 'wb')
> -        f.write(data)
> -        f.close()
> -        self.emit('self-dp-changed', tempfolder)
> -
> +        fd, fn = tempfile.mkstemp(prefix='emsnpic')
> +        os.write(fd, data)
> +        self.emit('self-dp-changed', fn)
> +
>          return False
> 
>      def onSetDP(self, response):
> 
> 
> -------- Original Message --------
> Subject: emesene preditable temporary filename
> Date: Tue, 25 May 2010 00:42:07 +0200
> From: Emilio Pozuelo Monfort <pochu@...ian.org>
> To: vendor-sec@....de, Mariano Guerra <luismarianoguerra@...il.com>, 
> "Riccardo
> (C10uD)" <c10ud.dev@...il.com>
> 
> Hi,
> 
> emesene 1.6.1 uses a predictable temporary filename (/tmp/emsnpic) to
> store a
> picture. This can lead a malicious local user to overwrite arbitrary
> files from
> the user who executes emesene by a symlink attack.
> 
> I've successfully exploited this by making a symlink from a test
> account to a
> file owned by the user 'emilio'. Then after running emesene, the file
> is
> overwritten with the picture (there are cases where it doesn't, but it
> will
> always happen on first login and if you login with another user then
> back with
> yours).
> 
> Before running emesene:
> 
> lrwxrwxrwx 1 test    test    4 may 24 22:25 emsnpic -> file
> -rw-r--r-- 1 emilio  emilio  5 may 24 22:23 file
> 
> After running emesene:
> 
> lrwxrwxrwx 1 test    test       4 may 24 22:25 emsnpic -> file
> -rw-r--r-- 1 emilio  emilio  3032 may 24 22:26 file
> 
> emilio@...urno:/tmp$ file file
> file: JPEG image data, JFIF standard 1.01
> 
> Should this get assigned a CVE number?
> 
> Regards,
> Emilio

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.