Bug 247483 – app-mobilephone/smsclient-2.0.8z (and others?) symlink attacks (CVE-2008-5155)

• Status: RESOLVED INVALID
• Product: Gentoo Security

[Description Stefan Behte (RETIRED) 2008-11-18 19:11:36 UTC]

CVE-2008-5155 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-5155):
  mail2sms.sh in smsclient 2.0.8z allows local users to overwrite
  arbitrary files via a symlink attack on a (1) /tmp/header.##### or
  (2) /tmp/body.##### temporary file, or append data to arbitrary files
  via a symlink attack on the (3) /tmp/sms.log temporary file.

[Comment 1 Stefan Behte (RETIRED) 2008-11-18 19:13:55 UTC]

Not yet verified, sorry.

[Comment 2 Stefan Behte (RETIRED) 2008-11-30 16:23:44 UTC]

OK, we're vulnerable:

# grep "/tmp/" ./contrib/mail2sms-shell/mail2sms.sh
/usr/bin/cp /dev/null /tmp/header.$$
  echo "$LINE" >> /tmp/header.$$
SENDER=`head -n 1 /tmp/header.$$ | awk '{print $2}'`
TARGET=`grep ^Subject: /tmp/header.$$ | awk '{print $2}'`
  echo "$LINE" >> /tmp/body.$$
  MSG=`cat /tmp/body.$$`
  /usr/bin/sms_client $TARGET "$MSG" >> /tmp/sms.log
rm /tmp/header.$$
rm /tmp/body.$$

[Comment 3 Alin Năstac (RETIRED) 2008-12-13 13:03:50 UTC]

mail2sms is not installed by smsclient.

Craig, for avoiding further noise about this issue, please check if those scripts you find to be vulnerable are also present in the ${D} directory.

Closed as INVALID.

[Comment 4 Stefan Behte (RETIRED) 2008-12-13 14:56:33 UTC]

Sorry, as my current machine is a bit slow I just unpacked and missed it. :(