This is a relatively minor issue, hence no embargo.
Michael Scherer (mscherer () redhat com) of Red Hat found:
Looking for incorrect /tmp/ usage, I found the following piece of code
in /usr/share/gems/gems/ruby_parser-2.0.4/lib/gauntlet_rubyparser.rb
(https://rubygems.org/gems/ruby_parser)
def diff_pp o1, o2
require 'pp'
File.open("/tmp/a.#{$$}", "w") do |f|
PP.pp o1, f
end
File.open("/tmp/b.#{$$}", "w") do |f|
PP.pp o2, f
end
`diff -u /tmp/a.#{$$} /tmp/b.#{$$}`
ensure
File.unlink "/tmp/a.#{$$}" rescue nil
File.unlink "/tmp/b.#{$$}" rescue nil
end
This was assigned CVE-2013-0162. The current version of ruby_parser is
3.1.1 and is affected. Fixing this is simple:
diff --git a/lib/gauntlet_rubyparser.rb b/lib/gauntlet_rubyparser.rb
index 4463c38..85137f9 100755
- --- a/lib/gauntlet_rubyparser.rb
+++ b/lib/gauntlet_rubyparser.rb
@@ -35,18 +35,19 @@ class RubyParserGauntlet < Gauntlet
def diff_pp o1, o2
require 'pp'
- - File.open("/tmp/a.#{$$}", "w") do |f|
- - PP.pp o1, f
- - end
+ file_a = Tempfile.new('ruby_parser_a')
+ PP.pp o1, file_a
+ file_a.close
+
+ file_b = Tempfile.new('ruby_parser_b')
+ PP.pp o2, file_b
+ file_b.close
- - File.open("/tmp/b.#{$$}", "w") do |f|
- - PP.pp o2, f
- - end
- - `diff -u /tmp/a.#{$$} /tmp/b.#{$$}`
+ `diff -u #{file_a.path} #{file_b.path}`
ensure
- - File.unlink "/tmp/a.#{$$}" rescue nil
- - File.unlink "/tmp/b.#{$$}" rescue nil
+ file_a.unlink
+ file_b.unlink
end
CC'ing the 3 people listed on ruby_parser as "owners".
Also I will be auditing a number of rubygems for various easy things,
as a reminder tmp file vulns are EASY to fix, just use the functions
listed in:
http://kurt.seifried.org/2012/03/14/creating-temporary-files-securely/
===============================
Public Service Announcement
===============================
For public issues please start CC'ing oss-security@ (especially if it
needs a CVE), and also rubysec () googlegroups com which will notify the
Ruby Security people (and then cool things like their tools will warn
users of outdated/insecure versions and so on).
For private/embargoed issues the rubygems.org/community is considering
some ways to make it easier to report security issues in gems, we'll
keep you posted.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
