Re: Fwd: emesene preditable temporary filename

[Josh Bressers <bressers () redhat com>]

Please use CVE-2010-2053.

Thanks.

-- 
    JB


----- "Emilio Pozuelo Monfort" <pochu () debian org> wrote:

> Hi,
>
> I sent this to vendor-sec but got no response. I've been told to send
> it to
> oss-security, so here it goes.
>
> The fix is:
>
> --- emesene-1.6.1/emesenelib/ProfileManager.py        2010-03-29
> 22:27:23.000000000 +0200
> +++ emesene-1.6.2/emesenelib/ProfileManager.py        2010-05-26
> 21:51:32.000000000 +0200
> @@ -208,16 +211,10 @@ class ProfileManager(gobject.GObject):
>              return False
>          data = response.read()
>          #print "DP:", len(data), stat, reas
> -        if os.name == "nt":
> -            tempfolder = os.environ['TEMP'] + os.sep + "emsnpic"
> -            tempfolder = unicode(tempfolder)
> -        else:
> -            tempfolder = '/tmp/emsnpic'
> -        f = open(tempfolder, 'wb')
> -        f.write(data)
> -        f.close()
> -        self.emit('self-dp-changed', tempfolder)
> -
> +        fd, fn = tempfile.mkstemp(prefix='emsnpic')
> +        os.write(fd, data)
> +        self.emit('self-dp-changed', fn)
> +
>          return False
>
>      def onSetDP(self, response):
>
>
> -------- Original Message --------
> Subject: emesene preditable temporary filename
> Date: Tue, 25 May 2010 00:42:07 +0200
> From: Emilio Pozuelo Monfort <pochu () debian org>
> To: vendor-sec () lst de, Mariano Guerra <luismarianoguerra () gmail com>, 
> "Riccardo
> (C10uD)" <c10ud.dev () gmail com>
>
> Hi,
>
> emesene 1.6.1 uses a predictable temporary filename (/tmp/emsnpic) to
> store a
> picture. This can lead a malicious local user to overwrite arbitrary
> files from
> the user who executes emesene by a symlink attack.
>
> I've successfully exploited this by making a symlink from a test
> account to a
> file owned by the user 'emilio'. Then after running emesene, the file
> is
> overwritten with the picture (there are cases where it doesn't, but it
> will
> always happen on first login and if you login with another user then
> back with
> yours).
>
> Before running emesene:
>
> lrwxrwxrwx 1 test    test    4 may 24 22:25 emsnpic -> file
> -rw-r--r-- 1 emilio  emilio  5 may 24 22:23 file
>
> After running emesene:
>
> lrwxrwxrwx 1 test    test       4 may 24 22:25 emsnpic -> file
> -rw-r--r-- 1 emilio  emilio  3032 may 24 22:26 file
>
> emilio@saturno:/tmp$ file file
> file: JPEG image data, JFIF standard 1.01
>
> Should this get assigned a CVE number?
>
> Regards,
> Emilio