| Main Archive Page > Month Archives > oss-security archives |
[oss-security] Fwd: emesene preditable temporary filename
From: Emilio Pozuelo Monfort <pochu_at_nospam>Date: Sat May 29 2010 - 15:17:21 GMT
To: oss-security@lists.openwall.com
Hi,
I sent this to vendor-sec but got no response. I've been told to send it to
oss-security, so here it goes.
The fix is:
--- emesene-1.6.1/emesenelib/ProfileManager.py 2010-03-29 22:27:23.000000000 +0200
+++ emesene-1.6.2/emesenelib/ProfileManager.py 2010-05-26 21:51:32.000000000 +0200
@@ -208,16 +211,10 @@ class ProfileManager(gobject.GObject):
return False
data = response.read()
#print "DP:", len(data), stat, reas
- if os.name == "nt":
- tempfolder = os.environ['TEMP'] + os.sep + "emsnpic"
- tempfolder = unicode(tempfolder)
- else:
- tempfolder = '/tmp/emsnpic'
- f = open(tempfolder, 'wb')
- f.write(data)
- f.close()
- self.emit('self-dp-changed', tempfolder)
-
+ fd, fn = tempfile.mkstemp(prefix='emsnpic')
+ os.write(fd, data)
+ self.emit('self-dp-changed', fn)
+
return False
def onSetDP(self, response):
-------- Original Message --------
Subject: emesene preditable temporary filename
Date: Tue, 25 May 2010 00:42:07 +0200
From: Emilio Pozuelo Monfort <pochu@debian.org>
To: vendor-sec@lst.de, Mariano Guerra <luismarianoguerra@gmail.com>, "Riccardo
(C10uD)" <c10ud.dev@gmail.com>
Hi,
emesene 1.6.1 uses a predictable temporary filename (/tmp/emsnpic) to store a
picture. This can lead a malicious local user to overwrite arbitrary files from
the user who executes emesene by a symlink attack.
I've successfully exploited this by making a symlink from a test account to a
file owned by the user 'emilio'. Then after running emesene, the file is
overwritten with the picture (there are cases where it doesn't, but it will
always happen on first login and if you login with another user then back with
yours).
Before running emesene:
lrwxrwxrwx 1 test test 4 may 24 22:25 emsnpic -> file
-rw-r--r-- 1 emilio emilio 5 may 24 22:23 file
After running emesene:
lrwxrwxrwx 1 test test 4 may 24 22:25 emsnpic -> file
-rw-r--r-- 1 emilio emilio 3032 may 24 22:26 file
emilio@saturno:/tmp$ file file
file: JPEG image data, JFIF standard 1.01
Should this get assigned a CVE number?
Regards,
Emilio