Date: Sat, 5 Nov 2011 14:27:54 +0400 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: Re: CVE request: unsafe use of /tmp in multiple CPAN modules On Fri, Nov 04, 2011 at 02:32:50PM -0500, John Lightsey wrote: > Symlink A points to foo/bar > Symlink B points to /some/real/directory > > Code asks for /tmp/parent/childXXXX > > Attacker hardlinks symlink A to /tmp/parent > Attacker creates /tmp/foo directory > Attacker hardlinks symlink B to /tmp/foo/bar > > Now everything looks safe, but it relies on the attacker controled > /tmp/foo directory. Yes, in the above scenario everything would look safe to the current code with your symlink-safety.patch. We could enhance the patch to also check parent directories of each symlink, but even then an attack would remain possible: Attacker hardlinks symlink B to /tmp/parent Then depending on what /some/real/directory actually is, this may be a security problem - e.g., if /some/real/directory is /etc/cron.d or /bin. And even for most other directories, there's likely a DoS and quota bypass possibility here. > It'd probably be simplest if File::Temp::_is_safe() didn't allow any > symlinks at all. Many systems have /tmp itself as a symlink. Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.