bugtraq - Symlink Vulnerability in GNU libtool <1.5.2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4019B011.5010405@informatik.hu-berlin.de>
Date: Fri, 30 Jan 2004 02:14:57 +0100
From: Stefan Nordhausen <deletethis.nordhaus@...ormatik.hu-berlin.de>
To: bugtraq@...urityfocus.com
Subject: Symlink Vulnerability in GNU libtool <1.5.2

Vulnerable:      libtool <1.5.2
Not Vulnerable:  libtool 1.5.2
Project website: http://www.gnu.org/software/libtool/libtool.html

Description of libtool (from website):
"GNU libtool is a generic library support script. Libtool hides the
complexity of using shared libraries behind a consistent, portable
interface."
Libtool is included with many packages that rely on it to handle
libraries. As a result these packages are vulnerable as well.

Discussion:
I found a symlink vulnerability in libtool prior to version 1.5.2.
Libtool insecurely creates a temporary directory when a package using
libtool is being compiled.

I want to point out that this bug is _only_ exploitable at compile time. 
The binaries that are produced during compilation are _not_ affected. As
a result, systems that rely exclusively on binary packages are not
affected at all.

Solution:
Updating to libtool 1.5.2 (the current stable release) will eliminate
the vulnerability. If you want to stick with your old version of libtool
you can easily fix this bug yourself. In "ltmain.in" (or file "libtool", 
whichever applies for you) you should replace the line:

if $mkdir -p "$tmpdir" && chmod 700 "$tmpdir"; then :

with

if $mkdir "$tmpdir" && chmod 700 "$tmpdir"; then :

Packages sometimes bring their own version of libtool. As a result, 
fixing the libtool that is installed on your system may not be enough. 
To solve this problem, package maintainers should fix their packages if 
they use libtool!

Regards
Stefan Nordhausen

-- 
Don't open your eyes, you won't like what you see. The blind have been
blessed with security. Don't open your eyes, take it from me. I have
found, you can find happiness in slavery.
    Trent Reznor