oss-security - CVE request and heads-up on insecure temp file handling in unpack200 (OpenJDK, Oracle Java)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <142BCE00-6581-4515-A8A1-E2C25CAFD923@redhat.com>
Date: Mon, 03 Feb 2014 15:02:27 -0700
From: "Vincent Danen" <vdanen@...hat.com>
To: "OSS Security List" <oss-security@...ts.openwall.com>
Cc: secalert_us@...cle.com
Subject: CVE request and heads-up on insecure temp file handling in unpack200
 (OpenJDK, Oracle Java)

I don't believe a CVE has been assigned or requested for this yet.  Spotted this on Debian's bug tracker and filed our own bug, the description of which follows which should serve to describe the issue.  I'm not sure if this affects IBM's JDK, but it seems to affect Oracle's (based on a quick test on my mac), so cc'ing Oracle here.

I'm not sure if MITRE will be handling the assignment or if Oracle will, but as this had already been reported publicly to the Debian BTS, I didn't think there was a point in _not_ sending this to oss-sec.

Thanks.

Jakub Wilk reported in a Debian bug report that the unpack200 program included in OpenJDK did not properly handle the logfile properly.  If the the log file was unable to be opened, it would create /tmp/unpack.log instead as the fallback, but do so in an insecure manner, as shown in unpack.cpp (the below is from OpenJDK 6):

4732 void unpacker::redirect_stdio() {
...
4757 #else
4758     sprintf(tmpdir,"/tmp");
4759     sprintf(log_file_name, "/tmp/unpack.log");
4760 #endif
4761     if ((errstrm = fopen(log_file_name, "a+")) != NULL) {
4762       log_file = errstrm_name = saveStr(log_file_name);
4763       return ;
4764     }
4765
4766     char *tname = tempnam(tmpdir,"#upkg");
4767     sprintf(log_file_name, "%s", tname);
4768     if ((errstrm = fopen(log_file_name, "a+")) != NULL) {
4769       log_file = errstrm_name = saveStr(log_file_name);
4770       return ;
4771     }

The same exists in OpenJDK 7 and 8.

This could allow a malicious local attacker to conduct local attacks, such as symlink attacks, where a file could be overwritten if the user running unpack200 had write permissions.

References:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562
https://bugzilla.redhat.com/show_bug.cgi?id=1060907

-- 
Vincent Danen / Red Hat Security Response Team
Download attachment "signature.asc" of type "application/pgp-signature" (711 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.