oss-security - CVE-2010 Request -- blender: Insecure temporary file use by creating file string in undo save quit Blender kernel routine (re-occurrence of CVE-2008-1103)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1422053670.30227855.1346949801345.JavaMail.root@redhat.com>
Date: Thu, 6 Sep 2012 12:43:21 -0400 (EDT)
From: Jan Lieskovsky <jlieskov@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Paul Wise <pabs@...ian.org>, Cyril Brulebois <kibi@...ian.org>
Subject: CVE-2010 Request -- blender: Insecure temporary file use by
 creating file string in undo save quit Blender kernel routine
 (re-occurrence of CVE-2008-1103)

Hello Kurt, Steve, vendors,

  an insecure temporary file use flaw was found in the way
'undo save quit' routine of Blender kernel of Blender, a 3D
modeling, animation, rendering and post-production software
solution, performed management of 'quit.blend' temporary file,
used for session recovery purposes. A local attacker could use
this flaw to conduct symbolic link attacks, leading to ability
to overwrite arbitrary system file, accessible with the privileges
of the user running the blender executable.

Upstream ticket:
[1] https://projects.blender.org/tracker/index.php?func=detail&aid=22509&group_id=9&atid=498

References:
[2] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=584621

This seems to be / is a re-occurrence of the CVE-2008-1103 flaw:
[3] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1103
[4] https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-1103
[5] https://bugs.launchpad.net/ubuntu/+source/blender/+bug/6671
[6] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=298167

Could you allocate a CVE-2010- identifier for this?

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

P.S.: Please note upstream seems to dispute the necessity
      of the fix for this (Followup #1 after Paul's report).

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.