CAN-2004-0970: Insecure temporary files

Automatically imported from Debian bug report #279208 http://bugs.debian.org/279208

Message-ID: <email address hidden>
Date: Mon, 1 Nov 2004 14:20:09 +0100
From: Martin Schulze <email address hidden>
To: <email address hidden>
Subject: CAN-2004-0970: Insecure temporary files

--w5er4h4/Yf2qR8D9
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline

Package: gzip
Version: 1.3.5-9
Severity: grave
Tags: sarge, sid, security, patch

Trustix developers discovered insecure temporary file creation in
supplemental scripts in the gzip package that can allows local users
to overwrite files via a symlink attack.

Please let me know which version fixes these problems in sid/sarge
while I take care of the package in woody.

I'm attaching the patch from Trustix and the patch I'm using for the
package in woody.

Regards,

 Joey

--
This is GNU/Linux Country. On a quiet night, you can hear Windows reboot.

Please always Cc to me when replying to me on the lists.

--w5er4h4/Yf2qR8D9
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: attachment; filename="gzip-1.2.4-tempfile.patch"

diff -ur gzip-1.2.4a.orig/gzexe.in gzip-1.2.4a/gzexe.in
--- gzip-1.2.4a.orig/gzexe.in 2004-09-13 11:14:21.000000000 +0200
+++ gzip-1.2.4a/gzexe.in 2004-09-13 11:36:08.000000000 +0200
@@ -13,7 +13,7 @@
 # The : is required for some old versions of csh.
 # On Ultrix, /bin/sh is too buggy, change the first line to: #!/bin/sh5

-x=`basename $0`
+x=`basename "$0"`
 if test $# = 0; then
   echo compress executables. original file foo is renamed to foo~
   echo usage: ${x} [-d] files...
@@ -21,9 +21,6 @@
   exit 1
 fi

-tmp=gz$$
-trap "rm -f $tmp; exit 1" 1 2 3 5 10 13 15
-
 decomp=0
 res=0
 test "$x" = "ungzexe" && decomp=1
@@ -32,12 +29,10 @@
   shift
 fi

-echo hi > zfoo1$$
-echo hi > zfoo2$$
-if test -z "`(${CPMOD-cpmod} zfoo1$$ zfoo2$$) 2>&1`"; then
- cpmod=${CPMOD-cpmod}
+cpmod=
+if type ${CPMOD:-cpmod} 2>/dev/null; then
+ cpmod=${CPMOD:-cpmod}
 fi
-rm -f zfoo[12]$$

 tail=""
 IFS="${IFS= }"; saveifs="$IFS"; IFS="${IFS}:"
@@ -75,9 +70,14 @@
     continue
   fi
   case "`basename $i`" in
- gzip | tail | chmod | ln | sleep | rm)
+ bash | chmod | gzip | ln | mktemp | rm | sed | sh | tail)
  echo "${x}: $i would depend on itself"; continue ;;
   esac
+
+ tmp=`/bin/mktemp -t gzexe.XXXXXXXXXX` || exit 1
+ trap "rm -f $tmp; exit 1" HUP INT QUIT PIPE TERM
+ trap "rm -f $tmp; exit 0" EXIT
+
   if test -z "$cpmod"; then
     cp -p "$i" $tmp 2>/dev/null || cp "$i" $tmp
     if test -w $tmp 2>/dev/null; then
@@ -128,6 +128,7 @@
       :
     else
       echo ${x}: $i probably not in gzexe format, file unchanged.
+ rm -f $tmp
       res=1
       continue
     fi
diff -ur gzip-1.2.4a.orig/zdiff.in gzip-1.2.4a/zdiff.in
--- gzip-1.2.4a.orig/zdiff.in 1993-08-17 00:32:16.000000000 +0200
+++ gzip-1.2.4a/zdiff.in 2004-09-13 11:32:22.000000000 +0200
@@ -47,10 +47,11 @@
                 case "$2" in
          *[-.]gz* | *[-.][zZ] | *.t[ga]z)
    F=`echo "$2" | sed 's|.*/||;s|[-.][zZtga]*||'`
- gzip -cdfq "$2" > /tmp/"$F".$$
- gzip -cdfq "$1" | $comp $OPTIONS - /tmp/"$F".$$
+ TF="`/bin/mktemp -t "$F".XXXXXX`" || exit 1
+ ...

Created an attachment (id=670)
interdiff for security update 1.3.5-9ubuntu3.1

I did not completely used the proposed patch, because I think that some parts
are broken.

Same fix for Warty and Hoary, can be uploaded at any time.

Proposed advisory detail text:

Recently, Trustix Secure Linux discovered some vulnerabilities in the
gzip package. The programs "znew", "zdiff", and "gzexe" created
temporary files in an insecure way, which allowed a symlink attack to
create or overwrite arbitrary files with the privileges of the user
invoking the program.

Argh, since the scripts run with noclobber ("set -C"), this is actually a
non-issue. Thanks to Matt for pointing me at this.

Message-ID: <email address hidden>
Date: Wed, 03 Nov 2004 09:32:22 -0700
From: Bdale Garbee <email address hidden>
To: <email address hidden>
Subject: set -C

This is a duplicate of #278277, which mdz closed as not being a problem for
Debian because of the use of 'set -C' in these scripts, which prevents
truncation of existing files during redirection.

Closing this one with no action taken on the same justification.

Bdale