emesene preditable 1.6.1 temporary filename

2010.06.12
Risk: Low
Local: Yes
Remote: No
CWE: CWE-59


CVSS Base Score: 3.3/10
Impact Subscore: 4.9/10
Exploitability Subscore: 3.4/10
Exploit range: Local
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: Partial

I sent this to vendor-sec but got no response. I've been told to send it to oss-security, so here it goes. The fix is: --- emesene-1.6.1/emesenelib/ProfileManager.py 2010-03-29 22:27:23.000000000 +0200 +++ emesene-1.6.2/emesenelib/ProfileManager.py 2010-05-26 21:51:32.000000000 +0200 @@ -208,16 +211,10 @@ class ProfileManager(gobject.GObject): return False data = response.read() #print "DP:", len(data), stat, reas - if os.name == "nt": - tempfolder = os.environ['TEMP'] + os.sep + "emsnpic" - tempfolder = unicode(tempfolder) - else: - tempfolder = '/tmp/emsnpic' - f = open(tempfolder, 'wb') - f.write(data) - f.close() - self.emit('self-dp-changed', tempfolder) - + fd, fn = tempfile.mkstemp(prefix='emsnpic') + os.write(fd, data) + self.emit('self-dp-changed', fn) + return False def onSetDP(self, response): -------- Original Message -------- Subject: emesene preditable temporary filename Date: Tue, 25 May 2010 00:42:07 +0200 From: Emilio Pozuelo Monfort <pochu@debian.org> To: vendor-sec@lst.de, Mariano Guerra <luismarianoguerra@gmail.com>, "Riccardo (C10uD)" <c10ud.dev@gmail.com> Hi, emesene 1.6.1 uses a predictable temporary filename (/tmp/emsnpic) to store a picture. This can lead a malicious local user to overwrite arbitrary files from the user who executes emesene by a symlink attack. I've successfully exploited this by making a symlink from a test account to a file owned by the user 'emilio'. Then after running emesene, the file is overwritten with the picture (there are cases where it doesn't, but it will always happen on first login and if you login with another user then back with yours). Before running emesene: lrwxrwxrwx 1 test test 4 may 24 22:25 emsnpic -> file -rw-r--r-- 1 emilio emilio 5 may 24 22:23 file After running emesene: lrwxrwxrwx 1 test test 4 may 24 22:25 emsnpic -> file -rw-r--r-- 1 emilio emilio 3032 may 24 22:26 file emilio@saturno:/tmp$ file file file: JPEG image data, JFIF standard 1.01 Should this get assigned a CVE number? Regards, Emilio

References:

http://forum.emesene.org/index.php?topic=3441.0
http://xforce.iss.net/xforce/xfdb/59045
http://www.emesene.org/
http://secunia.com/advisories/39945
http://osvdb.org/65018
http://marc.info/?l=oss-security&m=127514641525366&w=2


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top