Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list] 
Message-ID: <51285E51.8040308@redhat.com>
Date: Fri, 22 Feb 2013 23:14:41 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
        sven@...nhartge.de, jari.aalto@...te.net
Subject: CVE-2013-0350 for pktstat: writes content from TCP streams to public
 readable file /tmp/smtp.log

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Please use CVE-2013-0350 for this issue:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701211

pktstat: writes content from TCP streams to public readable file
/tmp/smtp.log


Sven Hartge <sven@...nhartge.de> reports:

Package: pktstat
Version: 1.8.5-2
Severity: normal
Tags: security

Hi!

I noticed pktstat creates a file with a fixed name in /tmp and writes
debugging
info gathered from the sniffed TCP streams into it:

redacted:/tmp# ls -al smtp.log
- -rw-r--r-- 1 root root 236726 Feb 22 21:30 smtp.log

Content is something like this:

- -----------8<---------------------
smpt_line [EHLO mail.example.com]
normalized to [EHLO mail.example.com]
set desc to: [EHLO mail.example.com]
smpt_line [STARTTLS]
normalized to [STARTTLS]
set desc to: [STARTTLS]
smpt_line [EHLO mail.example.com]
normalized to [EHLO mail.example.com]
set desc to: [EHLO mail.example.com]
smpt_line [STARTTLS]
normalized to [STARTTLS]
set desc to: [STARTTLS]
smpt_line [EHLO mail.example.com]
normalized to [EHLO mail.example.com]
set desc to: [EHLO mail.example.com]
- -----------8<---------------------

This is troublesome on several levels in my opinion:

a) the filename is always the same. Since pktstat is normally run as
root, this
   can be used for a symlink attack, at least to overwrite important
files with
   garbage

b) the file is normally world readable, depending on root's umask and
may contain
   sensitive information.

c) if pktstat is left running for some time on a busier network
interface, this
   logfile can get quite big and possibly fill /tmp or /.

The code responsible is in tmp_smtp.c:

oweh@...tname:~/apt/pktstat-1.8.5$ grep log *
tcp_smtp.c:FILE*log;
tcp_smtp.c:if ((log = fopen("/tmp/smtp.log", "a")))
tcp_smtp.c:   fprintf(log, "smpt_line [%s]\n", line);
tcp_smtp.c:if (log)fprintf(log, "normalized to [%s]\n", line);
tcp_smtp.c:if (log)fprintf(log, "from_addr = [%s]\n", state->from_addr);
tcp_smtp.c:if (log)fprintf(log, "to_addr = [%s]\n", state->to_addr);
tcp_smtp.c:if (log)fprintf(log, "set desc to: [%s]\n", f->desc);
tcp_smtp.c:if (log)fclose(log);

> From the indention and formatting of said code I gather it is
leftover debug
code, never intended to be released.

Just removing all of the above lines is sufficient to close this bug.

Gr￟e,
Sven.


- -- System Information:
Debian Release: 7.0
  APT prefers unstable
  APT policy: (600, 'unstable'), (500, 'experimental'), (400, 'testing')
Architecture: i386 (x86_64)
Foreign Architectures: amd64

Kernel: Linux 3.7-trunk-amd64 (SMP w/12 CPU cores)
Locale: LANG=de_DE.utf8, LC_CTYPE=de_DE.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages pktstat depends on:
ii  libc6        2.13-38
ii  libncurses5  5.9-10
ii  libpcap0.8   1.3.0-1
ii  libtinfo5    5.9-10

pktstat recommends no packages.

pktstat suggests no packages.

- -- no debconf information


- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJRKF5RAAoJEBYNRVNeJnmTpNUQAKtUGX1w05EW68y7njFx4HH/
jco1g4gSRvUD0SZmG3FkElfj9O9YnIcTuzTUskQgNn23WS+aS4K9LpGPo5lPdS0q
5X5Gd+/oYtOKn0q2DqIDtTPte75xPGhGpx3miLA/MBYultEbrugKBo/UVRgoP5YI
fHvwzQFMQKM32wHepE0FRaF3iH9XwhSrqebPtj5MzxOM+ioNaoMUqe3nM++7+ypI
fmCgqHh3ov4ZzL+ukS6cJSdNmMPgKrbnJ6d6DjfwU0peHQd2iHqcMDaha1ycc+Gx
KcuL5+JFvMo8b1ut/SVR8nsTl9jucXyL/y5O/wttzP0pfEznWC7RaV9SUZ15Gh+x
I65gkzCOeaCUdr7SxQjp9i1ntbWT0xv68LOWeqsCUm7Vup4lkcTHKpkf70E0pJx1
g+IEyjqYjTBecQoYtNKx6hvg7Gm41ROJJumX/8a7t2XTziPC8NNpUTFnJqQWf/iT
ZPqdJjW07oBsiSUcTcNksH8163cAfZQcSWwR5jCEW0NwAyLOW5JQEsI9BWYzKeW+
GdljKOA4971BYjrXSlepkWj7FY+PqWr2lgG5ymNHAYkVY4nNknIvqLahknilDDB6
yamM2yHhWcqSpX6aLzAjS57g8qqVD55EERQBy6E+oNNVyr6Co/OxVNSt0qZh1yv8
iN+YJAvs4L5pN8s6OahR
=5Z7R
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.