Bug 94471 – net-im/centericq <= 4.20.0 insecure temporary file creation

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Romang 2005-05-30 01:17:59 UTC]

Hello,

src/hooks/gaduhook.cc

909     fname = (getenv("TMPDIR") ? getenv("TMPDIR") : "/tmp");
910     fname += "/gg.token." + i2str(getpid());

912     ofstream bf(fname.c_str());
913 
914     if(bf.is_open()) {
915         bf.write(h->body, h->body_size);
916         bf.close();
917     } else {
918         return "";
919     }

Maybe could permit overwrite off arbitrary files with the right of the user using centericq. Symlink attack.

Regards.

[Comment 1 Sune Kloppenborg Jeppesen (RETIRED) 2005-05-30 08:26:45 UTC]

Auditors please verify. 

[Comment 2 Tavis Ormandy (RETIRED) 2005-06-11 09:54:23 UTC]

yep, clear cut.

[Comment 3 Romang 2005-06-13 07:35:39 UTC]

Hello,

I contact upstream.

Regards.

[Comment 4 Sune Kloppenborg Jeppesen (RETIRED) 2005-06-23 05:14:25 UTC]

Romang any news on this one? 

[Comment 5 Thierry Carrez (RETIRED) 2005-06-24 06:16:32 UTC]

Pulling in maintainers.

This is not public yet, but since upstream doesn't seem to answer we might have
to patch it ourselves...

[Comment 6 Romang 2005-06-27 00:37:05 UTC]

Hello,

Reported on [e-mail]

Regards.

[Comment 7 Thierry Carrez (RETIRED) 2005-07-03 02:42:22 UTC]

We'll need a patch for that one (or mask/drop it ?).
No upstream and no answer from downstream maintainers, ad will be public by
tomorrow.

[Comment 8 Thierry Carrez (RETIRED) 2005-07-05 05:05:02 UTC]

Pulling in net-im herd. Should we design a patch for it ? Drop it ?

[Comment 9 Wolfram Schlich (RETIRED) 2005-07-08 02:17:58 UTC]

I will talk to Konst (the author) now, who
coincidentally is a friend of mine ;)
Sorry for the delay.

We could also just disable Gadu-Gadu in our
ebuild btw., as it seems to be GG specific only.

[Comment 10 Wolfram Schlich (RETIRED) 2005-07-08 02:46:09 UTC]

thekonst:
08.07 11:40 I am very busy at the moment
08.07 11:41 I would appreciate if someone sends me a patch

so, any volunteers? :)
if not, I will just hard-disable GG in our ebuild with the
corresponding configure parameter.
objections? ideas?

[Comment 11 Thierry Carrez (RETIRED) 2005-07-18 05:04:16 UTC]

Created attachment 63690 [details, diff]
centericq-CAN-2005-1914.diff

Patch from Martin Schulze for Debian DSA 754-1

[Comment 12 Thierry Carrez (RETIRED) 2005-07-18 05:05:27 UTC]

Wolfram:
Please patch using the Debian patch (if it applies somewhat OK to our version).
Feel free to forward it upstream if they don't already have it.

[Comment 13 Wolfram Schlich (RETIRED) 2005-07-18 09:13:07 UTC]

http://article.gmane.org/gmane.network.centericq/3582

We already have updated CVS sources. I have to check them out and make a patch...

[Comment 14 Wolfram Schlich (RETIRED) 2005-07-18 09:36:04 UTC]

done -- =net-im/centericq-4.20.0-r2 is now the only remaining version in portage
and it contains the fix from the CenterICQ CVS repo.

[Comment 15 Sune Kloppenborg Jeppesen (RETIRED) 2005-07-18 09:51:01 UTC]

Thx Wolfram, please don't close security bugs.  
  
Security this one is ready for GLSA vote. I tend to vote NO.  

[Comment 16 Thierry Carrez (RETIRED) 2005-07-18 11:44:45 UTC]

I agree on no. This is on a specific config (GG) + typically runs as user, and
on mono-user envs. Reopen if you disagree.

[Comment 17 Wolfram Schlich (RETIRED) 2005-07-18 13:27:33 UTC]

whoops, sorry for closing the bug... it felt like I was the assignee, but I
wasn't =)