oss-security - CVE request: automake: insecure use of /tmp in install-sh

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20140912122940.GC3410@mail.corp.redhat.com>
Date: Fri, 12 Sep 2014 14:29:40 +0200
From: Vasyl Kaigorodov <vkaigoro@...hat.com>
To: oss-security@...ts.openwall.com
Cc: 760455@...s.debian.org
Subject: CVE request: automake: insecure use of /tmp in install-sh

Hello,

It was discovered [1] that there's an issue in how automake handles
temp directories.

When the destination directory does not exist, install-sh checks if 
"mkdir -p" works, but it does so in an insecure way. Here are the 
relevant parts of the code:

mkdirprog=${MKDIRPROG-mkdir}
# ...
        tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
        trap 'ret=$?; rmdir "$tmpdir/d" "$tmpdir" 2>/dev/null; exit
$ret' 0

        if (umask $mkdir_umask &&
        exec $mkdirprog $mkdir_mode -p -- "$tmpdir/d") >/dev/null 2>&1
        then
# ...
          rmdir "$tmpdir/d" "$tmpdir"
        else
# ...

In some shells (such as dash) $RANDOM is not set, so $tmpdir is easily 
predictable. Moreover, "mkdir -p" follows symlinks to existing 
directories. Local attacker can exploit this to create or remove empty 
directories named "d". (But on modern Linux systems this is mitigated
by the protected_symlinks feature.)

References:
[1]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=760455
[2]: https://bugzilla.redhat.com/show_bug.cgi?id=1140725
[3]: https://bugs.gentoo.org/show_bug.cgi?id=522638

Can a CVE ID be assigned to this please?

Thanks.
-- 
Vasyl Kaigorodov | Red Hat Product Security
PGP:  0xABB6E828 A7E0 87FF 5AB5 48EB 47D0 2868 217B F9FC ABB6 E828

Content of type "application/pgp-signature" skipped

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.