XBoard Unsafe Temporary Files May Let Local Users Gain Elevated Privileges
|
|
SecurityTracker Alert ID: 1008375
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Dec 4 2003
|
Impact: Modification of system information, Modification of user information, User access via local system
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 4.2.6 and prior versions
|
Description: A vulnerability was reported in the XBoard chessboard graphical interface in the 'pxboard' script. A local user may be able to gain elevated privileges
It is reported that pxboard creates temporary files in an unsafe manner in the '/tmp' directory. A local user can create a symbolic
link (symlink) from a critical file on the system to a temporary file to be used by pxboard. Then, when pxboard is executed by
a target user, the symlinked file will be created or overwritten with the privileges of the target user.
According to the report,
pxboard is not used by default and is only used when explicitly called.
|
Impact: A local user can create or modify a file with the privileges of the user running XBoard.
|
Solution: A fixed version (4.2.7) is available at:
http://ftp.gnu.org/gnu/xboard/xboard-4.2.7.tar.gz
|
Vendor URL: www.tim-mann.org/xboard.html (Links to External Site)
|
Cause: Access control error, State error
|
Underlying OS: Linux (Any), UNIX (Any)
|
Reported By: Martin Maaok <martin.macok@underground.cz>
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 3 Dec 2003 08:22:22 +0100
From: Martin Maaok <martin.macok@underground.cz>
Subject: XBoard < 4.2.7: pxboard insecure tmp file handling
|
About XBoard:
XBoard is a graphical chessboard that can serve as a user interface
to chess engines (such as GNU Chess), the Internet Chess Servers,
electronic mail correspondence chess, or your own collection of
saved games. pxboard is a script that saves its standard input to
a temporary file and invokes "xboard -loadGameFile file &" on the
file. pxboard is a part of XBoard package. It is not used by default,
only when explicitely called.
More info: http://www.tim-mann.org/xboard.html
The BUG:
pxboard in XBoard 4.2.6 and older creates/writes to a file with
a predictable filename in /tmp directory. In a multiuser environment
malicious user could use this vulnerability to force pxboard user to
overwrite any file she has write access to.
The fix:
1) Upgrade to XBoard 4.2.7
OR
2) Replace pxboard script with the following one:
#!/bin/sh
tmp=`mktemp "${TMPDIR:-/tmp}/pxboard.$$.XXXXXX"` || exit 1
cat > "$tmp"
( xboard -ncp -lgf "$tmp" "$@" ; rm "$tmp" ) &
--
Martin Mačok http://underground.cz/
martin.macok@underground.cz http://Xtrmntr.org/ORBman/
|
|
