bugtraq - XBoard < 4.2.7: pxboard insecure tmp file handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 3 Dec 2003 08:22:22 +0100
From: Martin Mačok <martin.macok@...erground.cz>
To: bugtraq@...urityfocus.com
Subject: XBoard < 4.2.7: pxboard insecure tmp file handling

About XBoard:

XBoard is a graphical chessboard that can serve as a user interface
to chess engines (such as GNU Chess), the Internet  Chess Servers,
electronic  mail  correspondence  chess,  or  your own collection of
saved games. pxboard is a script that saves its standard input to
a temporary file and invokes "xboard -loadGameFile file &" on the
file. pxboard is a part of XBoard package. It is not used by default,
only when explicitely called.

More info: http://www.tim-mann.org/xboard.html

The BUG:

pxboard in XBoard 4.2.6 and older creates/writes to a file with
a predictable filename in /tmp directory. In a multiuser environment
malicious user could use this vulnerability to force pxboard user to
overwrite any file she has write access to.

The fix:

1) Upgrade to XBoard 4.2.7

OR

2) Replace pxboard script with the following one:

#!/bin/sh
tmp=`mktemp "${TMPDIR:-/tmp}/pxboard.$$.XXXXXX"` || exit 1
cat > "$tmp"
( xboard -ncp -lgf "$tmp" "$@" ; rm "$tmp" ) &

-- 
         Martin Mačok                 http://underground.cz/
   martin.macok@...erground.cz        http://Xtrmntr.org/ORBman/