I noticed pktstat creates a file with a fixed name in /tmp and writes debugging info gathered from the sniffed TCP streams into it:
redacted:/tmp# ls -al smtp.log
- -rw-r--r-- 1 root root 236726 Feb 22 21:30 smtp.log
Content is something like this:
- -----------8<---------------------
smpt_line [EHLO mail.example.com]
normalized to [EHLO mail.example.com]
set desc to: [EHLO mail.example.com]
smpt_line [STARTTLS]
normalized to [STARTTLS]
set desc to: [STARTTLS]
smpt_line [EHLO mail.example.com]
normalized to [EHLO mail.example.com]
set desc to: [EHLO mail.example.com]
smpt_line [STARTTLS]
normalized to [STARTTLS]
set desc to: [STARTTLS]
smpt_line [EHLO mail.example.com]
normalized to [EHLO mail.example.com]
set desc to: [EHLO mail.example.com]
- -----------8<---------------------
This is troublesome on several levels in my opinion:
a) the filename is always the same. Since pktstat is normally run as
root, this
can be used for a symlink attack, at least to overwrite important
files with
garbage
b) the file is normally world readable, depending on root's umask and
may contain
sensitive information.
c) if pktstat is left running for some time on a busier network
interface, this
logfile can get quite big and possibly fill /tmp or /.
The code responsible is in tmp_smtp.c:
oweh () hostname:~/apt/pktstat-1.8.5$ grep log *
tcp_smtp.c:FILE*log;
tcp_smtp.c:if ((log = fopen("/tmp/smtp.log", "a")))
tcp_smtp.c: fprintf(log, "smpt_line [%s]\n", line);
tcp_smtp.c:if (log)fprintf(log, "normalized to [%s]\n", line);
tcp_smtp.c:if (log)fprintf(log, "from_addr = [%s]\n", state->from_addr);
tcp_smtp.c:if (log)fprintf(log, "to_addr = [%s]\n", state->to_addr);
tcp_smtp.c:if (log)fprintf(log, "set desc to: [%s]\n", f->desc);
tcp_smtp.c:if (log)fclose(log);
From the indention and formatting of said code I gather it is
leftover debug
code, never intended to be released.
Just removing all of the above lines is sufficient to close this bug.
Gr￟e,
Sven.
- -- System Information:
Debian Release: 7.0
APT prefers unstable
APT policy: (600, 'unstable'), (500, 'experimental'), (400, 'testing')
Architecture: i386 (x86_64)
Foreign Architectures: amd64
Kernel: Linux 3.7-trunk-amd64 (SMP w/12 CPU cores)
Locale: LANG=de_DE.utf8, LC_CTYPE=de_DE.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages pktstat depends on:
ii libc6 2.13-38
ii libncurses5 5.9-10
ii libpcap0.8 1.3.0-1
ii libtinfo5 5.9-10
pktstat recommends no packages.
pktstat suggests no packages.
- -- no debconf information
