bugtraq - Re: Symlink Vulnerability in GNU libtool <1.5.2

Open Source and information security mailing list archives

Message-ID: <1075840438.20240.160.camel@descent.netsplit.com>
Date: Tue, 03 Feb 2004 20:33:58 +0000
From: Scott James Remnant <scott@...split.com>
To: "Joseph S. Myers" <jsm@...yomino.org.uk>
Cc: bugtraq@...urityfocus.com, Libtool Bugs <bug-libtool@....org>,
	Libtool Patches <libtool-patches@....org>
Subject: Re: Symlink Vulnerability in GNU libtool <1.5.2

On Tue, 2004-02-03 at 09:47, Joseph S. Myers wrote:

> On Fri, 30 Jan 2004, Stefan Nordhausen wrote:
> > Solution:
> > Updating to libtool 1.5.2 (the current stable release) will eliminate
> > the vulnerability. If you want to stick with your old version of libtool
> > you can easily fix this bug yourself. In "ltmain.in" (or file "libtool", 
> > whichever applies for you) you should replace the line:
> > 
> The chmod has a race (that access to the temporary directory could be
> gained after it is created but before it is chmoded)
> 
Would this patch be sufficient?  Gary et al. okay to apply if it is?

----8<--------8<--------8<--------8<--------8<--------8<--------8<--------8<----
2003-02-03  Scott James Remnant  <scott@...split.com>

	* ltmain.in: Create temporary directory under a strict umask
	rather than running chmod afterwards, preventing a race
	condition where the directory could be replaced with a symbolic
	link in the time between the two commands.

diff -u -r1.334.2.20 ltmain.in

--- ltmain.in   3 Feb 2004 19:55:29 -0000       1.334.2.20
+++ ltmain.in   3 Feb 2004 20:29:07 -0000
@@ -5673,11 +5673,15 @@
              tmpdir="/tmp"
              test -n "$TMPDIR" && tmpdir="$TMPDIR"
              tmpdir="$tmpdir/libtool-$$"
-             if $mkdir "$tmpdir" && chmod 700 "$tmpdir"; then :
+             save_umask=`umask`
+             umask 0077
+             if $mkdir "$tmpdir"; then
+               umask $save_umask
              else
+               umask $save_umask
                $echo "$modename: error: cannot create temporary directory \`$tmpdir'" 1>&2
                continue
              fi
              file=`$echo "X$file$stripped_ext" | $Xsed -e 's%^.*/%%'`
              outputname="$tmpdir/$file"
              # Replace the output file specification.
---->8-------->8-------->8-------->8-------->8-------->8-------->8-------->8----

Scott
-- 
Have you ever, ever felt like this?
Had strange things happen?  Are you going round the twist?


Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)

_______________________________________________
Bug-libtool mailing list
Bug-libtool@....org
http://mail.gnu.org/mailman/listinfo/bug-libtool



lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives