exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

STG Security Advisory 2004-11-22.9

STG Security Advisory 2004-11-22.9
Posted Dec 11, 2004
Authored by STG Security | Site stgsecurity.com

STG Security Advisory: cscope is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files with the right of the user running them, which could be root.

tags | advisory, arbitrary, local, root
SHA-256 | 22aff0b7a3b9fece18550c0a926a047f9299775940d5a1168595ac6a867ae897

STG Security Advisory 2004-11-22.9

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

STG Security Advisory: [SSA-20041122-09] cscope insecure temp file creation
vulnerability

Revision 1.2
Date Published: 2004-11-22 (KST)
Last Update: 2004-11-22
Disclosed by SSR Team (advisory@stgsecurity.com)

Summary
========
cscope is an interactive, screen-oriented tool that allows users to
browse through C source files for specified elements of code.

It is vulnerable to symlink attacks, potentially allowing a local user to
overwrite arbitrary files with the right of the user running them, which
could be root.


Vulnerability Class
===================
Design error: insecure temp file handling


Details
=======
cscope was not designed to handle temp file securely.

main.c 332 line
/* create the temporary file names */
pid = getpid();
(void) sprintf(temp1, "%s/cscope%d.1", tmpdir, pid);
(void) sprintf(temp2, "%s/cscope%d.2", tmpdir, pid);

temporary files created with predictable names.
/tmp/cscope[pid].1
/tmp/cscope[pid].2

If temp1, temp2 are assigned once, they aren't changed until cscope is
terminated. Because cscope uses temp1, temp2 values repeatedly whenever
user
searches specified element of code, it's trivial to guess the names of temp
files.

Impact
======
Medium: System file corruption.

Workaround
==========
Do *NOT* run cscope as the right of root.

rexolab's patch isn't the correct patch to this problem.
cscope is made with C language, not PHP language, fopen() doesn't support
mode 'x' in C library.

Affected Products
================
cscope 15.5 and prior

Vendor Status: NOT FIXED
=======================
2003-04-03 Vulnerability found by Jeremy Bae(aka opt, *^^*)
(http://xsdeny.net/kweblog/stories.php?story=03/04/03/9181080)
2004-11-08 cscope developer notified.
2004-11-17 rexolab released the advisory irresponsibly and incorrectly.
2004-11-22 Official release.

Credits
======
Jeremy Bae at STG Security

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0

iQA/AwUBQaP3zD9dVHd/hpsuEQLOGACguBVlVe9myH978BHK+obHw6oPu1EAoOrH
NrR86vgntUyQNJ7MacySBuBw
=qDsj
-----END PGP SIGNATURE-----

Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    0 Files
  • 3
    Feb 3rd
    0 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    0 Files
  • 7
    Feb 7th
    0 Files
  • 8
    Feb 8th
    0 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close