Forward: Bug#138975: hotplug: /tmp symlink vulnerability

PATCH Fumitoshi UKAI 2 participants 3 messages Mar 19, 2002

Share & tools

Fumitoshi UKAI

author

2002-03-19 01:39 UTC #0 lore raw

Hi,

I received the following bug report.
It actually create any files on tye system by dangling symlinking in /tmp/test.<number> (touch follows symlinks).

Anyway as report said, I think it's better to touch /tmp itself instead of touch /tmp/test.$$ and remove it.
If directory is writable, touch the directory will be success, otherwise touch will be failed.

How about this ?

Index: etc/hotplug/ieee1394.agent
===================================================================
RCS file: /cvsroot/linux-hotplug/admin/etc/hotplug/ieee1394.agent,v retrieving revision 1.3

hotplug/ieee1394.agent +2 -2

diff -u -u -r1.3 ieee1394.agent
@@ -33,9 +33,9 @@
 
 # if called too early in booting, things break
 # (bash creates tempfiles)
-if touch /tmp/test.$$ >/dev/null 2>&1
+if touch /tmp >/dev/null 2>&1
 then
-	rm -f /tmp/test.$$
+	: ok
 else
 	mesg Need writable /tmp ...
 	exit 1

Regards,
Fumitoshi UKAI

Package: hotplug
Version: 0.0.20020114-5
Severity: normal
File: /etc/hotplug/ieee1394.agent
Tags: security

Seen in /etc/hotplug/ieee1394.agent:

	if touch /tmp/test.$$ >/dev/null 2>&1
	then
		rm -f /tmp/test.$$
	else
		mesg Need writable /tmp ...
		exit 1
	fi

Not only does this follow symlinks when it executes as root, thereby allowing someone to create files all over the system, but it also removes innocent files created under /tmp whose names happen to coincide with the PID of the agent...

A better approach would be to try to create a directory under /tmp. That won't work if the /tmp disk is full, but on the other hand not much is going to work in such a state anyway.

An even better approach would be to try to touch /tmp itself--if that fails, you certainly won't be able to write files in subdirectories of /tmp.

-- System Information
Debian Release: 3.0
Architecture: i386
Kernel: Linux satsuki 2.4.18-pre7aa2-zb-p3-laptop #1 Sat Feb 9 17:03:54 EST 2002 i686
Locale: LANG=C, LC_CTYPE=

Versions of packages hotplug depends on:

ii  debconf                       1.0.26     Debian configuration management sy
ii  modutils                      2.4.13-3   Linux module utilities.

David Brownell

2002-03-19 01:51 UTC #1 lore raw

Looks right to me, except that some other agent scripts had the same general need for writable /tmp so maybe a more generic fix, done once, would be] a better way to go.

- Dave

----- Original Message -----
From: "Fumitoshi UKAI" <[email protected]>
To: <[email protected]>
Sent: Monday, March 18, 2002 5:39 PM
Subject: Forward: Bug#138975: hotplug: /tmp symlink vulnerability

Quoted 32 lines

Hi,
I received the following bug report.
It actually create any files on tye system by dangling symlinking in /tmp/test.<number> (touch follows symlinks).
Anyway as report said, I think it's better to touch /tmp itself instead of touch /tmp/test.$$ and remove it.
If directory is writable, touch the directory will be success, otherwise touch will be failed.
How about this ?
Index: etc/hotplug/ieee1394.agent
=================================> RCS file: /cvsroot/linux-hotplug/admin/etc/hotplug/ieee1394.agent,v retrieving revision 1.3
diff -u -u -r1.3 ieee1394.agent
hotplug/ieee1394.agent 19 Mar 2002 01:36:56 -0000 renamed from hotplug/ieee1394.agent 4 Jan 2002 18:39:49 -0000 1.3 +2 -2
@@ -33,9 +33,9 @@
 
 # if called too early in booting, things break
 # (bash creates tempfiles)
-if touch /tmp/test.$$ >/dev/null 2>&1
+if touch /tmp >/dev/null 2>&1
 then
- rm -f /tmp/test.$$
+ : ok
 else
  mesg Need writable /tmp ...
  exit 1

Quoted 4 lines

Regards,
Fumitoshi UKAI

_______________________________________________
Linux-hotplug-devel mailing list http://linux-hotplug.sourceforge.net
[email protected]
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel

Fumitoshi UKAI

author

2002-03-19 16:51 UTC #2 lore raw

In reply to Fumitoshi UKAI

At Mon, 18 Mar 2002 17:51:17 -0800,

Quoted 4 lines · David Brownell

Looks right to me, except that some other agent scripts had the same general need for writable /tmp so maybe a more generic fix, done once, would be] a better way to go.

I committed this patch.
But I can't find any reason why this check is in ieee1394.agent only. Which part of ieee1394.agent requires /tmp is writable? Doesn't other agent need to check as well?

Regards,
Fumitoshi UKAI

Quoted 39 lines

----- Original Message -----
From: "Fumitoshi UKAI" <[email protected]>
To: <[email protected]>
Sent: Monday, March 18, 2002 5:39 PM
Subject: Forward: Bug#138975: hotplug: /tmp symlink vulnerability
Quoted 32 lines
Hi,
I received the following bug report.
It actually create any files on tye system by dangling symlinking in /tmp/test.<number> (touch follows symlinks).
Anyway as report said, I think it's better to touch /tmp itself instead of touch /tmp/test.$$ and remove it.
If directory is writable, touch the directory will be success, otherwise touch will be failed.
How about this ?
Index: etc/hotplug/ieee1394.agent
=================================> > RCS file: /cvsroot/linux-hotplug/admin/etc/hotplug/ieee1394.agent,v retrieving revision 1.3
diff -u -u -r1.3 ieee1394.agent
hotplug/ieee1394.agent 19 Mar 2002 01:36:56 -0000 renamed from hotplug/ieee1394.agent 4 Jan 2002 18:39:49 -0000 1.3 +2 -2
@@ -33,9 +33,9 @@
 
 # if called too early in booting, things break
 # (bash creates tempfiles)
-if touch /tmp/test.$$ >/dev/null 2>&1
+if touch /tmp >/dev/null 2>&1
 then
- rm -f /tmp/test.$$
+ : ok
 else
  mesg Need writable /tmp ...
  exit 1

Quoted 12 lines

Quoted 4 lines
Regards,
Fumitoshi UKAI
_______________________________________________
Linux-hotplug-devel mailing list http://linux-hotplug.sourceforge.net
[email protected]
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel