full-disclosure - Gambas 3.3.4 Directory hijack vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-id: <db8018fd-f741-42b3-97c6-fcd2fa798272@me.com>
Date: Wed, 27 Feb 2013 17:29:19 +0000 (GMT)
From: "Larry W. Cashdollar" <larry0@...com>
To: Full Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Gambas 3.3.4 Directory hijack vulnerability

Gambas 3.3.4 Directory hijack vulnerability

The gambas software package creates a directory in tmp to work from without verifying another 
user hasn't already created it. This allows a local user to hijack ownership.  This advisory was taken
from the bug filed with the developers.

Describe the problem:

Gambas creates a directory in /tmp called gambas.UID where UID is the user id of the person 
running the software. Gambas doesn't check to see if a malicious user has already created that 
directory.

A malicious user can then manipulate (mv or remove) that directory once gambas has created files 
under it.
larry@...quot:/tmp$ mkdir gambas.0
larry@...quot:/tmp$ ls -ld gambas.0
drwxr-xr-x 2 larry staff 4096 2012-12-13 16:37 gambas.0 larry@...quot:/tmp$ cd gambas.0
larry@...quot:/tmp/gambas.0$ ls
larry@...quot:/tmp/gambas.0$ ls -l
total 4
drwx------ 2 root root 4096 2012-12-13 16:37 25257 larry@...quot:/tmp/gambas.0$ rm -rf 25257 larry@...quot:/tmp/gambas.0$

User larry was able to remove the directory gambas created as root.

2) Software Details

Version: gambas3-runtime-3.3.4~lucid2
Revision:
Operating system: Linux
Distribution: Ubunt
Architecture: x86_64
GUI component: QT3 / QT4 / GTK+
Desktop used: Gnome

3) Provide a little project that reproduces the bug or the crash.

ubuntu-builder runs as root

See bug posted here for details and fix from vendor:

http://code.google.com/p/gambas/issues/detail?id=365

@_larry0 Larry W. Cashdollar

http://otiose.dhs.org

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/