Bug 170569 – net-analyzer/netperf Insecure file creation (CVE-2007-1444)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Pierre-Yves Rofes (RETIRED) 2007-03-12 14:01:21 UTC]

Ben Hutchings has discovered a vulnerability in netperf, which can be
exploited by malicious, local users to perform certain actions with
escalated privileges.

The vulnerability is caused due to the file "/tmp/netperf.debug"
being created insecurely during the start of "netserver". This can be
exploited via symlink attacks to overwrite arbitrary files with
privileges of the user running netserver.

The vulnerability is confirmed in version 2.4.3. I just check the last stable version we ship (2.3) and it's also vulnerable.

[Comment 1 Raphael Marichez (Falco) (RETIRED) 2007-03-16 00:17:40 UTC]

That's so dirty :/


Easy to fix while we're waiting for upstream, but I would rather use syslog rather than a temporary file, what do you think netmon or security?

[Comment 2 Pierre-Yves Rofes (RETIRED) 2007-03-26 17:59:29 UTC]

still upstream...

[Comment 3 Raphael Marichez (Falco) (RETIRED) 2007-04-09 19:06:11 UTC]

no news from upstream yet

[Comment 4 Markus Ullmann (RETIRED) 2007-04-30 22:40:54 UTC]

looks like a fix or am I wrong here?
svn log http://www.netperf.org/svn/netperf2/ | less

r104 | raj | 2007-04-04 00:40:51 +0200 (Wed, 04 Apr 2007) | 1 line
create per-child debug log files with the pid appended when netserver in debug

[Comment 5 Pierre-Yves Rofes (RETIRED) 2007-05-03 18:07:31 UTC]

yes Markus, 2.4.4 fixes the initial problem. but still, even with this fix an attacker could create /tmp/netperf.debug1 /tmp/netperf.debug2 etc... He'd better to use mkstemp() instead.
Security, any opinion on this?

[Comment 6 Raphael Marichez (Falco) (RETIRED) 2007-05-07 21:58:26 UTC]

(In reply to comment #5)
> yes Markus, 2.4.4 fixes the initial problem. but still, even with this fix an
> attacker could create /tmp/netperf.debug1 /tmp/netperf.debug2 etc... He'd
> better to use mkstemp() instead.
> Security, any opinion on this?
> 

it doesn't fix anything from a security point of view :(

[Comment 7 Pierre-Yves Rofes (RETIRED) 2007-07-03 20:00:54 UTC]

Security, do we want a maskglsa for this one? I tend to vote no.

[Comment 8 Sune Kloppenborg Jeppesen (RETIRED) 2007-07-15 09:50:08 UTC]

Is the netperf.debug file created by default or only with specific options enabled?

[Comment 9 Pierre-Yves Rofes (RETIRED) 2007-07-15 10:27:52 UTC]

no it's not, you have to specify the "-d" flag when running it.

[Comment 10 Sune Kloppenborg Jeppesen (RETIRED) 2007-07-15 10:42:49 UTC]

Voting NO then.

[Comment 11 Matt Drew (RETIRED) 2007-07-16 12:58:07 UTC]

voting no.

[Comment 12 Peter Volkov (RETIRED) 2008-01-31 13:33:54 UTC]

Well, I was going to remove this package but found patch submitted by Nico Golde:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=413658

and bumped the package. Now it uses mkstemp() to create debug file name. Unmasking it.

I think we can close this bug now?

BTW, strange but seems that debian maintainer droped that patch and uses upstream provided code based on $pid. Does anybody have any time to report that there?

[Comment 13 Robert Buchholz (RETIRED) 2008-01-31 14:40:34 UTC]

I just added Nico to CC.

[Comment 14 nion 2008-02-04 13:22:06 UTC]

(In reply to comment #13)
> I just added Nico to CC.

Since logfiles don't really belong to /tmp but to /var/log the maintainer decided to change the log location. The patch itself is fine though.

[Comment 15 Sune Kloppenborg Jeppesen (RETIRED) 2008-02-10 14:42:55 UTC]

I'll close this with NO GLSA since we voted NO for mask GLSA. Feel free to reopen if you disagree.

[Comment 16 Sune Kloppenborg Jeppesen (RETIRED) 2008-02-10 15:14:08 UTC]

Bah, and now actually closing.