full-disclosure - Mozilla Thunderbird 0.8 / Firefox 0.9.3 temporary files (local)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: dveditz at cruzio.com (Daniel Veditz)
Subject: Mozilla Thunderbird 0.8 / Firefox 0.9.3 temporary
 files (local)

This was fixed Friday (bug 251297) and the fix will be in next versions of
Mozilla products.

It looks like the bug was introduced last March which would make Mozilla 1.7
and Firefox 0.9 and later vulnerable, Mozilla 1.6 and Firefox 0.8 and
earlier OK. Thunderbird has been vulnerable from version 0.6 on.

-Dan Veditz

Martin wrote:
> 
> Mozilla Thunderbird 0.8 / Firefox 0.9.3 temporary files (local)
> 
> Martin (broadcast@...aced.net)
> 
> -------------------
> Program Description
> -------------------
> 
> "Thunderbird, our latest email program, includes intelligent spam 
> filters, spell-checking, security, customization, and newsgroups 
> support."
> 
> www.mozilla.org
> 
> -------------------
> Problem Description
> -------------------
> 
> When opening an attachment, or a link included in an email, Thunderbird 
> prompts the user with a dialog box, giving the choice to "Save to Disk" 
> or to "Open with" <default program>.
> 
> For example, we receive a PDF document attached, and on the Attachments 
> section, we choose "Open". 
> 
> broadcast:/tmp$ ls -l *.pdf
> -rw-------  1 broadcast broadcast 2002560 2004-10-24 18:38 wskbq43m.pdf
> 
> While the dialog box is still open, the file permissions are OK, and the 
> filename is random (except for the extension). 
> If we choose to save it to disk, and check /tmp again:
> 
> broadcast:/tmp$ ls -l *.pdf
> ls: *.pdf: No such file or directory
> 
> Great, it's gone. Now let's choose to open it with the default viewer 
> (in my case, xpdf).
> Again, while the dialog box is open, there are no apparent problems.
> 
> broadcast:/tmp$ ls -l *.pdf
> -rw-------  1 broadcast broadcast 2002560 2004-10-24 18:42 hp1h30si.pd
> 
> But after choosing to open it with xpdf:
> 
> broadcast:/tmp$ ls -l *.pdf
> -rw-r--r--  1 broadcast broadcast 2002560 2004-10-24 18:42 programming.pdf
> 
> The file becomes world readable, until the user closes xpdf, or whatever 
> application he chose to read the attachment.
> Also, the filename becomes predictable, but if the filename already 
> exists on /tmp, Thunderbird will choose a similar filename, and won't 
> work on the existing one.
> 
> This exact issue affects Mozilla Firefox 0.9.3. I haven't tested 
> older/newer versions, and all of this was tested under Debian Unstable.
> 
> A copy of this advisory and future updates on this issue may be found on:
> http://broadcast.ptraced.net/advisories/008-firefox.thunderbird.txt