bugGNU TeXmacs - Bugs: bug #1789, temporary files are created in an...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #1789: temporary files are created in an insecure way

Submitted by:  David Allouche <ddaa>
Submitted on:  Sun 24 Nov 2002 01:12:36 AM UTC  
 
Category: File ManagerPriority: 9 - Immediate
Item Group: ErrorStatus: Fixed
Privacy: PublicAssigned to: Joris van der Hoeven <vdhoeven>
Originator Name: Open/Closed: Closed
Release: Release: 1.0.0.22
Fixed Release: NoneFixed Release: 1.0.1.23
Keywords: tmpnam mkstemp tmpfile

(Jump to the original submission Jump to the original submission)

Sat 20 Sep 2003 02:05:35 PM UTC, comment #9:

All temporary files should now be created in ~/.TeXmacs
This is not very clean, but at least it is secure.

PS: the exact fixed version is before 1.0.1.23.

David Allouche <ddaa>
Project Administrator
Wed 12 Feb 2003 09:59:07 PM UTC, comment #8:

Joris, you always get a file name with handle anyway. My previous comment still apply.

Igor V. Kovalenko <kovalenko>
Wed 12 Feb 2003 09:54:02 PM UTC, comment #7:

Well, this is a way brute force attack works.
I can suggest using temporary file name for file in ~/.TeXmacs/tmp/ or whatever not publically available.
~/.TeXmacs/ is available only to user who execute TeXmacs (presumably, anyway...) and user probably won't bruteforce himself.
I see the problem is either with loss of data or with security breach. First is solved with truely private filesystem subdirectory (such as $(HOME)/.TeXmacs/tmp). See what SSH (the secure shell) is doing : the server checks permissions to ~/.ssh to be some 600 :)
Second is best solved by refusing to execute as root (or whatever superuser).
Are we now creating ~/TeXmacs/tmp or what? :)

Igor V. Kovalenko <kovalenko>
Wed 12 Feb 2003 06:05:17 PM UTC, comment #6:

It is very unhandy that 'mkstemp' returns a file instead of a file name.
Why the hell is the obtention of a mere name which is not in use unsecure?
I can imagine that opening such a file in the wrong way is insecure,
but why can't I just get a free name? This is really annoying,
because certain types of treatments really need a name and not a file.
See for instance the following code, or the way we print documents...

static string
load_pdf (string file_name) {
string temp_name= get_temp_file_name ();
system ("pdf2ps " * file_name * " " * temp_name);
string s= load_postscript (temp_name);
system ("rm -f " * temp_name);
return s;
}

Joris van der Hoeven <vdhoeven>
Project AdministratorIn charge of this item.
Mon 30 Dec 2002 12:12:58 PM UTC, comment #5:

You made a nice point.

Then I think the fix proposed by Igor is acceptable.

David Allouche <ddaa>
Project Administrator
Sun 29 Dec 2002 06:54:51 PM UTC, comment #4:

Usually, /tmp has the "t-bit" set which means that an attacker
can not overwrite a file which doesn't belong to him.

Ralf Treinen <treinen>
Project Member
Tue 26 Nov 2002 12:25:01 PM UTC, comment #3:

That fix will narrow nothing because /tmp is generally world writable. So the file can be overwritten by the attacker. I am no security expert so I can hardly assess the risks here.

But that problem may allow an attacker to execute code using the privileges of the texmacs user. In itself that is not a root compromise but it is already bad enough, and elevated privileges allow the exploitation of additional vulnerabilities.

David Allouche <ddaa>
Project Administrator
Mon 25 Nov 2002 09:16:09 PM UTC, comment #2:

OK, the simple fix is to use 'mkstemp' and immediately close the file. This narrows the window of opportunity to perform 'bad things'.
The long-term fix IMO is not as simple, because there are shell-script system() calls in the execution path...

Igor V. Kovalenko <kovalenko>
Mon 25 Nov 2002 08:28:46 PM UTC, comment #1:

According to common usage pattern :) this is not a problem. This thing is bad here if root is editing a TeXmacs document, which should not be the case. Anyway, a patch is simle enough.

Igor V. Kovalenko <kovalenko>
Sun 24 Nov 2002 01:12:36 AM UTC, original submission:

When TeXmacs needs to create a temporary file, it uses tmpnam to produce a file name, and then pass it around to the function which create the file.

That way of doing is extremely insecure and is vulnerable to well known "/tmp symlink attack".

The proper way of handling temporary files is to use mkstemp, mkstemp or tmpfile (preferrably) to atomically create a temporary file.

David Allouche <ddaa>
Project Administrator

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 4 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Sat 20 Sep 2003 02:05:35 PM UTCddaaStatusNone=>(Error - Not Found)
  Open/ClosedAccepted=>(Error - Not Found)
  Fixed Release=>
Sun 01 Jun 2003 02:13:39 PM UTCddaaOpen/ClosedOpen=>(Error - Not Found)

Back to the top


Powered by Savane 3.1-cleanup1