Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 10 Jun 2009 21:23:11 +0200
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Cc: krahmer@...e.de
Subject: Re: xfig-3.2.5 diff (CVE-2009-1962)

Hi Sebastian!

On Mon, 8 Jun 2009 12:49:48 +0200 Sebastian Krahmer <krahmer@...e.de>
wrote:

> just in case you need it, our maintainer asked me to forward
> a patch for $SUBJECT which has been fixed in our xfig
> for quite some time.

Looks like the patch you attached does not differ much from what we use
for some time too and seems to have an origin here:

  https://bugzilla.redhat.com/show_bug.cgi?id=67351

And it does not differ much from what Nico previously posted:

  http://thread.gmane.org/gmane.comp.security.oss.general/1609

However, Nico's patch, probably taken from Fedora XFig packages, has
one hunk missing for:

u_print.c:    sprintf(tmp_fig_file, "%s/%s%06d", TMPDIR, "xfig-fig", getpid());

that seem to have been lost during 3.2.4 -> 3.2.5 patch
forward-porting.  This code is reached e.g. when you select File ->
Print -> Print figure to batch.

I've also grepped source for other obvious TMPDIR uses and here's my
list:

d_text.c:  sprintf(preedit_filename, "%s/%s%06d", TMPDIR, "xfig-preedit", getpid());

- This code if #ifdef I18N_USE_PREEDIT, though I do not see
  I18N_USE_PREEDIT defined anywhere.  Does not seem to be used in our
  builds.

f_util.c:     sprintf(tmpfile, "%s%s", TMPDIR, c);
f_util.c:     sprintf(tmpfile, "%s/%s", TMPDIR, plainname);

- This can be triggered if user tries to open zipped file in some
  directory where she can not write (it is used as "gunzip -c >
  tmpfile").  Warning is printed when TMPDIR is used, but it's still
  possible to perform symlink attack when victim can be tricked to open
  some attacker chosen file.

u_error.c:      if (emergency_save(strcat(TMPDIR,"/SAVE.fig")) == -1)

- This is emergency auto-save feature, executed when xfig is signaled
  or detect some X error.  Current directory is tried first, TMPDIR is
  fallback when current directory fails.

The latter two are not really temp files, so mkstemp may not be the
right fix here.

-- 
Tomas Hoger / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.