Re: xfig-3.2.5 diff (CVE-2009-1962)

[Tomas Hoger <thoger () redhat com>]

Hi Sebastian!

On Mon, 8 Jun 2009 12:49:48 +0200 Sebastian Krahmer <krahmer () suse de>
wrote:

> just in case you need it, our maintainer asked me to forward
> a patch for $SUBJECT which has been fixed in our xfig
> for quite some time.

Looks like the patch you attached does not differ much from what we use
for some time too and seems to have an origin here:

  https://bugzilla.redhat.com/show_bug.cgi?id=67351

And it does not differ much from what Nico previously posted:

  http://thread.gmane.org/gmane.comp.security.oss.general/1609

However, Nico's patch, probably taken from Fedora XFig packages, has
one hunk missing for:

u_print.c:    sprintf(tmp_fig_file, "%s/%s%06d", TMPDIR, "xfig-fig", getpid());

that seem to have been lost during 3.2.4 -> 3.2.5 patch
forward-porting.  This code is reached e.g. when you select File ->
Print -> Print figure to batch.

I've also grepped source for other obvious TMPDIR uses and here's my
list:

d_text.c:  sprintf(preedit_filename, "%s/%s%06d", TMPDIR, "xfig-preedit", getpid());

- This code if #ifdef I18N_USE_PREEDIT, though I do not see
  I18N_USE_PREEDIT defined anywhere.  Does not seem to be used in our
  builds.

f_util.c:     sprintf(tmpfile, "%s%s", TMPDIR, c);
f_util.c:     sprintf(tmpfile, "%s/%s", TMPDIR, plainname);

- This can be triggered if user tries to open zipped file in some
  directory where she can not write (it is used as "gunzip -c >
  tmpfile").  Warning is printed when TMPDIR is used, but it's still
  possible to perform symlink attack when victim can be tricked to open
  some attacker chosen file.

u_error.c:      if (emergency_save(strcat(TMPDIR,"/SAVE.fig")) == -1)

- This is emergency auto-save feature, executed when xfig is signaled
  or detect some X error.  Current directory is tried first, TMPDIR is
  fallback when current directory fails.

The latter two are not really temp files, so mkstemp may not be the
right fix here.

-- 
Tomas Hoger / Red Hat Security Response Team