oss-security - TMP flaw in rackspace jclouds?

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <53A2508B.4020208@redhat.com>
Date: Wed, 18 Jun 2014 20:52:59 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com, andrew@...l.org
Subject: TMP flaw in rackspace jclouds?

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

https://github.com/rackspace/jclouds/

So CC'ing Andrew, he's a consistent contributor, I can't file an issue
in Github (no link to it) so posting here and CC'ing him.

https://github.com/rackspace/jclouds/blob/master/scriptbuilder/src/main/java/org/jclouds/scriptbuilder/domain/Statements.java

  public static Statement extractTargzAndFlattenIntoDirectory(URI tgz,
String dest) {
      return new StatementList(ImmutableSet.<Statement> builder()
            .add(exec("mkdir /tmp/$$"))
            .add(extractTargzIntoDirectory(tgz, "/tmp/$$"))
            .add(exec("mkdir -p " + dest))
            .add(exec("mv /tmp/$$/*/* " + dest))
            .add(exec("rm -rf /tmp/$$")).build());
   }


This is insecure, $$ == PID == predictable

http://kurt.seifried.org/2012/03/14/creating-temporary-files-securely/

use java.io.File.createTempFile() ? some interesting info at
http://www.veracode.com/blog/2009/01/how-boring-flaws-become-interesting/

for directories there is a helpful posting at
http://stackoverflow.com/questions/617414/create-a-temporary-directory-in-java

Thanks.


- -- 
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQIcBAEBAgAGBQJTolCLAAoJEBYNRVNeJnmTrVYQAJ5glkD/0Ha5+F99Qj9ioNmm
ZnO4G6TqKctfiqW/X02wMocKLMRV8q5WI/nvs71hCoK5HaVmbtNrV71wE0omHLjB
smzFz6d8qZaTcOHdvgbSlWEGPjcVnESo0F3K0vgK2L/LtB5mgny6pHDn+c/cqrgt
Er4n+U3oXlkon/ksW+drWpKOpmGOhn7c4fbE45ci6KnzDbbGpGHF0fZL3lSEfJR0
0D/HQzKIAJpI7VvZU8+/d/MHasndgJoAHmUCkTBYU55Vf5eYsm+xWZ1Mt46IyAap
crMTCHHE1GVUAexYbMxy+lohHbpl+pB/d////LzesJjByRSv87r+1oLhdwank3P9
Fz1h3sq57JyLFQIcpm4TS7xh3TaByFGCiA5G/mR+CkuS6sZEapSkviu/x7ygmOdG
cJKM+5CogeE1P1PWsoQ41JcSwfuWAfc5IODvkjLb3MfyoXJRaKcBVdVcdHBUK4BA
7xcD9SbDsujxHOJLknFaO22uTtlrDS4yXJaNal6L9P7DCsSSrxG1PmmE+t5qrtYw
HQoz+RuOMhY/2FWJqOxa7ru99rIQmxxpWgoknUlT+yYJRfoub0kpibyJLBLy2SEx
xmdqe/i9nHCsGAworK4bEL2vLvsNBiJgdSHlzg7E5POI1tbveE12fIUmSgrgV+zO
WjPZ/O4oOj0FVWoeyQUN
=SUf5
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.