oss-security - CVE Request (gpicview)

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [thread-next>] [month] [year] [list]

Date: Mon, 25 Aug 2008 12:45:57 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: coley@...re.org
Cc: oss-security@...ts.openwall.com
Subject: CVE Request (gpicview)

Hello Steve,

  could you please allocate a CVE id for the following
three gpicview issues:

1,

http://sourceforge.net/tracker/index.php?func=detail&aid=2019481&group_id=180858&atid=894869

Possible symlink attack via the temporary created "/tmp/rot.jpg" 
file used for image rotation.

2,

http://sourceforge.net/tracker/index.php?func=detail&aid=2019485&group_id=180858&atid=894869

Related part of the code (the check for previous same filename file
existence is done only in the 'main_win_save' function):

#ifdef HAVE_LIBJPEG
    if(strcmp(type,"jpeg")==0){
        if(rotate_and_save_jpeg_lossless(file_name,mw->rotation_angle)!=0)
            main_win_show_error(mw, "Save failed! Check permissions.");
    } else
#endif
        main_win_save( mw, file_name, type, pref.ask_before_save ); 
        
By presence of the LIBJPEG library we could without confirmation rewrite
the by the symlink targeted JPEG filesystem file.

3, 

http://sourceforge.net/tracker/index.php?func=detail&aid=2019492&group_id=180858&atid=894869

Related part of the code:

void on_rotate_clockwise( GtkWidget* btn, MainWin* mw )
{
    rotate_image( mw, GDK_PIXBUF_ROTATE_CLOCKWISE );
    mw->rotation_angle += 90;
    if(pref.auto_save_rotated){
        pref.ask_before_save = FALSE;
        on_save(btn,mw);
        pref.ask_before_save = TRUE;
    }
}

Consequences: Bad enough, just think about them in context of the two
previously mentioned issues.

Public mention of these issues:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495968


Thank you in advance!

Kind regards
Jan iankko Lieskovsky
RH Security Resposne Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.