PHP version 5.5.13 and Lynis version 1.5.4 use /tmp insecurely.
e8fd9a05110d214b1f51e304a9c367e55a2709149d4453dfa7eef7d72082bdfb
After reading about today's "Check, rootkit" vulnerability (CVE-2014-0476),
I thought I'd share these stupid bugs:
BUG #1 - PHP's ./configure script writes a predictable filename to /tmp
allowing for a symlink attack against the user running the script
>From PHP 5.5.13:
18045 #include <stdio.h>
18046 int main(int argc, char *argv[])
18047 {
18048 FILE *fp;
18049 long position;
18050 char *filename = "/tmp/phpglibccheck";
18051
18052 fp = fopen(filename, "w");
18053 if (fp == NULL) {
18054 perror("fopen");
18055 exit(2);
18056 }
18057 fputs("foobar", fp);
18058 fclose(fp);
18059
18060 fp = fopen(filename, "a+");
18061 position = ftell(fp);
18062 fclose(fp);
18063 unlink(filename);
18064 if (position == 0)
18065 return 1;
18066 return 0;
18067 }
Reported to security@php.net twice, no response ever received:
September 22, 2012
January 8, 2013
This issue goes back at least 10+ years, but no one configures/compiles PHP
as root and your files aren't important anyway.
BUG #2 - Lynis 1.5.4 (and presumably earlier) writes a predictable filename
to /tmp allowing for a symlink attack against the user running the script
Website: rootkit.nl
This utility, which is similar in nature to "chkrootkit" and "rkhunter" and
must be run as root, also writes a predictable filename to /tmp (you'll
have to win a race for this one). Unreported, because this is security
software. Therefore it is secure. (The logic is intentional. What's to
report?)