full-disclosure - SimpleCDR-X - Insecure tempfile handling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu Sep 15 19:27:42 2005
From: jonas.thambert at hush.ai (jonas.thambert@...h.ai)
Subject: SimpleCDR-X - Insecure tempfile handling

SimpleCDR-X - Insecure tempfile handling
+----------------------------------------+
Date: 2005-09-15
URL: http://ogre.rocky-road.net/cdr.shtml
Vendor Notified: Days ago, no answer.
Version: 1.3.3 latest

[- Description -]

Files beeing recorded can be read by any user on the system due to 
insecure tempfile handling. By default all tempfiles are copied, 
packed and stored in the hidden directory /tmp/.temp while beeing 
recorded with incorrect set permissions. Not very nice if you 
backup your /etc or any other sensitive files.

Example.
jonas@...inity:/tmp$ ls -al
drwxr-xr-x 2 root root 4096 2005-09-15 18:41 .temp

jonas@...inity:/tmp$ cd .temp/
jonas@...inity:/tmp/.temp$ ls -al
drwxr-xr-x 2 root root 4096 2005-09-15 18:41 .
drwxrwxrwt 11 root root 4096 2005-09-15 18:41 ..
-rw-r--r-- 1 root root 205615104 2005-09-15 18:41 
simplecdrxbKtBVC.iso

[- Code Location -]
The function MasterDataCD::createImage in src/masterdatacd.cpp is 
hosting the vulnerable code.

[- Exploit -]
Not needed.

Concerned about your privacy? Follow this link to get
secure FREE email: http://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
http://www.hushmail.com/services-messenger?l=434

Promote security and make money with the Hushmail Affiliate Program: 
http://www.hushmail.com/about-affiliate?l=427