[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20121221110558.GA7583@netbsd.org>
Date: Fri, 21 Dec 2012 11:05:58 +0000
From: David Holland <dholland-oss-security@...bsd.org>
To: oss-security@...ts.openwall.com
Subject: Isearch insecure temporary files
NetBSD pkgsrc ships an old text search package called Isearch, which I
found tonight (in the course of making it compile with a modernish C++
compiler) to contain garden-variety /tmp races.
Does anyone else ship it? I don't think this is worth a CVE unless
someone does; the package appears to be dead upstream.
http://gnats.netbsd.org/47360 for reference; the relevant portions of
the patches cited follow.
--- doctype/anzmeta.cxx~ 2000-10-11 14:02:15.000000000 +0000
+++ doctype/anzmeta.cxx
@@ -1446,9 +1448,21 @@ ANZMETA::Present (const RESULT& ResultRe
} else {
STRING s_cmd;
//CHR* c_cmd;
- CHR *TmpName;
+ CHR TmpName[64];
+ int fd;
- TmpName = tempnam("/tmp", "mpout");
+ strcpy(TmpName, "/tmp/mpoutXXXXXX");
+ fd = mkstemp(TmpName);
+ if (fd < 0) {
+ /*
+ * Apparently failure is not an option here, so
+ * proceed in a way that at least won't be insecure.
+ */
+ strcpy(TmpName, "/dev/null");
+ }
+ else {
+ close(fd);
+ }
cout << "[ANZMETA::Present] no docs found, so build Fly cmd" << endl;
--- doctype/fgdc.cxx~ 2000-09-06 18:20:30.000000000 +0000
+++ doctype/fgdc.cxx
@@ -1824,10 +1826,22 @@ FGDC::Present (const RESULT& ResultRecor
return;
} else {
STRING s_cmd;
- CHR *TmpName;
-
- TmpName = tempnam("/tmp", "mpout");
+ CHR TmpName[64];
+ int fd;
+ strcpy(TmpName, "/tmp/mpoutXXXXXX");
+ fd = mkstemp(TmpName);
+ if (fd < 0) {
+ /*
+ * Apparently failure is not an option here, so
+ * proceed in a way that at least won't be insecure.
+ */
+ strcpy(TmpName, "/dev/null");
+ }
+ else {
+ close(fd);
+ }
+
BuildCommandLine(mpCommand, HoldFilename, RecordSyntax,
TmpName, &s_cmd);
system(s_cmd);
--- src/marc.cxx.orig 1998-05-12 16:49:10.000000000 +0000
+++ src/marc.cxx
@@ -194,9 +194,15 @@ MARC::GetPrettyBuffer(STRING *Buffer)
{
/*
// Cheese, cheese, cheese;-)
- char *tempfile = tempnam("/tmp", "marc");
+ char tempfile[32];
+ strcpy(tempfile, "/tmp/marcXXXXXX");
+ int tempfd = mkstemp(tempfile);
+ if (tempfd < 0) {
+ *Buffer = "MARC::GetPrettyBuffer() failed to open temp file";
+ return;
+ }
FILE *fp;
- if((fp = fopen(tempfile, "w")) == NULL) {
+ if((fp = fdopen(tempfd, "w")) == NULL) {
*Buffer = "MARC::GetPrettyBuffer() failed to open temp file";
return;
}
--
David A. Holland
dholland@...bsd.org
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
