what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

STG Security Advisory 2004-11-22.9

STG Security Advisory 2004-11-22.9
Posted Dec 11, 2004
Authored by STG Security | Site stgsecurity.com

STG Security Advisory: cscope is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files with the right of the user running them, which could be root.

tags | advisory, arbitrary, local, root
SHA-256 | 22aff0b7a3b9fece18550c0a926a047f9299775940d5a1168595ac6a867ae897

STG Security Advisory 2004-11-22.9

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

STG Security Advisory: [SSA-20041122-09] cscope insecure temp file creation
vulnerability

Revision 1.2
Date Published: 2004-11-22 (KST)
Last Update: 2004-11-22
Disclosed by SSR Team (advisory@stgsecurity.com)

Summary
========
cscope is an interactive, screen-oriented tool that allows users to
browse through C source files for specified elements of code.

It is vulnerable to symlink attacks, potentially allowing a local user to
overwrite arbitrary files with the right of the user running them, which
could be root.


Vulnerability Class
===================
Design error: insecure temp file handling


Details
=======
cscope was not designed to handle temp file securely.

main.c 332 line
/* create the temporary file names */
pid = getpid();
(void) sprintf(temp1, "%s/cscope%d.1", tmpdir, pid);
(void) sprintf(temp2, "%s/cscope%d.2", tmpdir, pid);

temporary files created with predictable names.
/tmp/cscope[pid].1
/tmp/cscope[pid].2

If temp1, temp2 are assigned once, they aren't changed until cscope is
terminated. Because cscope uses temp1, temp2 values repeatedly whenever
user
searches specified element of code, it's trivial to guess the names of temp
files.

Impact
======
Medium: System file corruption.

Workaround
==========
Do *NOT* run cscope as the right of root.

rexolab's patch isn't the correct patch to this problem.
cscope is made with C language, not PHP language, fopen() doesn't support
mode 'x' in C library.

Affected Products
================
cscope 15.5 and prior

Vendor Status: NOT FIXED
=======================
2003-04-03 Vulnerability found by Jeremy Bae(aka opt, *^^*)
(http://xsdeny.net/kweblog/stories.php?story=03/04/03/9181080)
2004-11-08 cscope developer notified.
2004-11-17 rexolab released the advisory irresponsibly and incorrectly.
2004-11-22 Official release.

Credits
======
Jeremy Bae at STG Security

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0

iQA/AwUBQaP3zD9dVHd/hpsuEQLOGACguBVlVe9myH978BHK+obHw6oPu1EAoOrH
NrR86vgntUyQNJ7MacySBuBw
=qDsj
-----END PGP SIGNATURE-----

Login or Register to add favorites

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    17 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    17 Files
  • 21
    May 21st
    18 Files
  • 22
    May 22nd
    7 Files
  • 23
    May 23rd
    111 Files
  • 24
    May 24th
    27 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close