Thu 02 Apr 2009 02:44:39 PM UTC, comment #5:
One thing you may be missing is Debian bug:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=433338
Which resulted in addition of the following:
+/**
+ * I consider this 'public exchange file' feature a bad idea, at least
+ * if this is the default case. I really don't like the idea of an admin
+ * copying configuration file snippets around that might get changed
+ * in that buffer file.
+ * Drop the notion of a 'public' exchange file. If someone explictly wants
+ * to share his copy buffer contents, he is free to chmod it after its
+ * creation.
+ * Jan Nordholz <hesso@pool.math.tu-berlin.de>, 2007/08/07
public = !strcmp(fn, DEFAULT_BUFFERFILE);
+ */
This was to avoid having exchange file with permission 0666, but accidentally introduced symlink issue for default exchange file, as the checks are less strict for non-public exchange files.
Thinking more about this, even without this change, one can possibly shoot himself in the foot by setting bufferfile to some non-default value, that is in a world-writeable directory (e.g. /tmp or /var/tmp). So the file will be treated as non-public, and fewer checks will be done before opening/creating it.
There also seem to be a theoretical race between lstat and open in the public code path. If attacker unlinks his screen-exchange file, victim creates new file on same filesystem, it may get the same dev/inode number as the original attacker's screen-exchange. If attacker symlinks it, test comparing lstat and fstat output may succeed, even the file is different. All those steps (unlink, create, symlink) need to happen in between lstat and open, while the attacker does not have a control over "create" and the created file is not likely to be a valuable target.
|