full-disclosure - Re: Vim: Insecure Temporary File Creation During Build: Arbitrary Code Execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.GSO.4.51.0807251156230.29569@faron.mitre.org>
Date: Fri, 25 Jul 2008 11:57:28 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: Jan MinÃ¡Å™ <rdancer@...ncer.org>
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
	full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com,
	vim-dev@....org, bugs@....org
Subject: Re: Vim: Insecure Temporary File Creation During
 Build: Arbitrary Code Execution


On Fri, 25 Jul 2008, [UTF-8] Jan MinÃ¡Å^Y wrote:

> > The commands do not have to be written there between (1) and (2), they
> > can be in the file long before the ./configure was started -- just
> > because the script does care whether it can write to the file at all.
> > So unlike stated in the advisory, and in CVE-2008-3294, the issue does
> > not involve a race condition if the attacker would choose to create a
> > 644 file.
>
> The file gets truncated in (1).  You're wrong, the advisory is right.

Maybe the point here is that if the attacker owns the file and sets 644
permissions, then the truncation won't happen since ./configure won't have
the permissions to modify the file.

- Steve


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/