Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 14 May 2008 17:38:12 +0200
From: Nico Golde <oss-security+ml@...lde.de>
To: oss-security@...ts.openwall.com
Subject: vim $TMPDIR directory stat (was: Re: CVE request: Emacs 21 fast-lock-mode arbitrary lips code execution)

Hi Tavis,
* Tavis Ormandy <taviso@....lonestar.org> [2008-05-14 17:03]:
> On Wed, May 14, 2008 at 04:03:34PM +0200, Sven Joachim wrote:
> > On 2008-05-14 15:27 +0200, Nico Golde wrote:
> > 
> > > As I am a vim user I might have done something wrong too, 
> > > not sure. What I did after installing emacs:
> 
> Same here, so out of curiosity i ran strace -efile -o log vim, and
> edited a few files. I observed vim looking for a directory called
> $TMPDIR in the wd, and using it as you would expect. Obviously a bug,
> and perhaps some minor security implications, anyone want to
> investigate? :-)

The reason is:
src/unix.h:
#  define TEMPDIRNAMES  "$TMPDIR", "/tmp", ".", "$HOME"

on startup vim then expands those paths and checks if the 
directory exists (that's where the stat comes from I think). 
If it exists it will use it as temporary directory to mkdir 
the temporary directory for vim files, v<somenumber>.

src/fileio.c:
   6811         for (i = 0; i < sizeof(tempdirs) / sizeof(char *); ++i)
   6812         {
   6813             /* expand $TMP, leave room for "/v1100000/999999999" */
   6814             expand_env((char_u *)tempdirs[i], itmp, TEMPNAMELEN - 20);
   6815             printf("expanded %s to %s\n", tempdirs[i], itmp);
   6816             if (mch_isdir(itmp))                /* directory exists */
   ....
   6843                     sprintf((char *)itmp + STRLEN(itmp), "v%ld", nr + off);
   6844 # ifndef EEXIST
   6845                     /* If mkdir() does not set errno to EEXIST, check for
   6846                      * existing file here.  There is a race condition then,
   6847                      * although it's fail-safe. */
   6848                     if (mch_stat((char *)itmp, &st) >= 0)
   6849                         continue;
   6850 # endif
   6851 #if defined(UNIX) || defined(VMS)
   6852                     /* Make sure the umask doesn't remove the executable bit.
   6853                      * "repl" has been reported to use "177". */
   6854                     umask_save = umask(077);
   6855 #endif
   6856                     r = vim_mkdir(itmp, 0700);


So it checks for $TMPDIR on your system because this 
environment variable is not set and therefore can't be expanded?!

You could redirect the temporary files of a user to a 
location the attacker and the victim has access to but vim 
still sets the correct permissions so this does not help the 
attacker. After a quick check this doesn't look like a 
security issue to me.

Kind regards
Nico
-- 
Nico Golde - http://www.ngolde.de - nion@...ber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.