Bug 95209 – net-firewall/giptables: Insecure Temporary File Creation

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Jean-François Brunette (RETIRED) 2005-06-06 06:18:52 UTC]

The vulnerability is caused due to temporary file being created insecurely.
This can be exploited via symlink attacks in combination with a race condition
to create and overwrite arbitrary files with the privileges of the user
running the affected script.

It is also possible to cause a Denial of Service by manipulating the
ip adresses present into the temporary file

The exploitation require that the root configure or reconfigure his firewall rules.

##########
Versions:
##########

GIPTables <= v1.1

[Comment 1 Jean-François Brunette (RETIRED) 2005-06-06 06:32:09 UTC]

Possible fix:

deny_file="$GIPTABLES_BLOCKED_FILE"

if mkdir "/tmp/.giptables.$$"; then
	chmod 700 /tmp/.giptables.$$
        temp_file="/tmp/.giptables.$$/temp.ip.addresses"
	else
        echo "$Error: failed to create temporary file" 1>&2
        exit 1
    fi
    temp_file="/tmp/.giptables.$$/temp.ip.addresses"

[Comment 2 Thierry Carrez (RETIRED) 2005-06-06 11:29:46 UTC]

Last version in June 09, 2002. Not sure it's worth patching... maybe a
mask/removal would be a better option. Pulling in dragonheart for input.

[Comment 3 Daniel Black (RETIRED) 2005-06-06 16:23:47 UTC]

I'm happy with a mask/removal  

[Comment 4 Thierry Carrez (RETIRED) 2005-06-08 01:31:06 UTC]

Masked prior to complete removal.

[Comment 5 Daniel Black (RETIRED) 2005-10-04 04:13:41 UTC]

giptables removed