Debian Bug report logs - #495705
lintian: Please improve insecure /tmp checks

Reply or subscribe to this bug.

Display info messages

Message #5 received at [email protected] (full text, mbox, reply):

From: "Dmitry E. Oboukhov" <[email protected]>

To: [email protected], Steve Kemp <[email protected]>

Cc: [email protected]

Subject: Re: Possible mass bug filing: The possibility of attack with the help of symlinks in some Debian packages

Date: Wed, 20 Aug 2008 00:07:31 +0400

[Message part 1 (text/plain, inline)]

Package: lintian
Tags: patch, security
Severity: wishlist

Hello, lintan maintainers!
please, see full discussion in -devel:
    http://lists.debian.org/debian-devel/2008/08/msg00271.html
for example, see the bug
	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494648
	(if attacker makes symlink from /tmp/twiki to /etc/shadow, then
	 he takes full access to the system (when twiki installs or
	 upgrades))




Hi all!

I wrote the check script for the lintian package. This additional check
verifies the debian packages for the presents of the discussed bug.

Notes and additions are welcome.

patch has been placed in attache

PS: X11 also uses the /tmp/.X11-unix directory, which may  be  used  for
attacks, I don't known :(

but many scripts (in different packages) use /tmp/.X11-unix, if this  is
not a security problem, may be I must add ignoring for this directory in
the lintian script?

I don't known yet :(

DEO> This message about the error concerns a few packages  at  once.   I've
DEO> tested all the packages on my Debian mirror.  (post|pre)(inst|rm)  and
DEO> config scripts were tested.

DEO> In some packages I've discovered scripts with errors which may be used
DEO> by a user for damaging important system files.

DEO> For example if a script uses in its work a temp file which is  created
DEO> in /tmp directory, then every user can create symlink  with  the  same
DEO> name in this directory in order to  destroy  or  rewrite  some	system
DEO> file.

DEO> I set Severity into grave for  this  bug.   The  table	of  discovered
DEO> problems is below.
--
... mpd is off

. ''`. Dmitry E. Oboukhov
: :’  : [email protected]
`. `~’ GPGKey: 1024D / F8E26537 2006-11-21
  `- 1B23 D4F8 8EC0 D902 0555  E438 AB8C 00CF F8E2 6537

[symlinks_attacks_check.diff (text/x-diff, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #10 received at [email protected] (full text, mbox, reply):

From: Russ Allbery <[email protected]>

To: "Dmitry E. Oboukhov" <[email protected]>

Cc: [email protected], [email protected], Steve Kemp <[email protected]>

Subject: Re: Bug#495705: Possible mass bug filing: The possibility of attack with the help of symlinks in some Debian packages

Date: Tue, 19 Aug 2008 13:17:12 -0700

"Dmitry E. Oboukhov" <[email protected]> writes:

> Package: lintian
> Tags: patch, security
> Severity: wishlist
>
> Hello, lintan maintainers!
> please, see full discussion in -devel:
>     http://lists.debian.org/debian-devel/2008/08/msg00271.html
> for example, see the bug
> 	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494648
> 	(if attacker makes symlink from /tmp/twiki to /etc/shadow, then
> 	 he takes full access to the system (when twiki installs or
> 	 upgrades))
>
> I wrote the check script for the lintian package. This additional check
> verifies the debian packages for the presents of the discussed bug.

Lintian already checks for this.  If the current check is not sufficient
(which is certainly believable), it should be improved, rather than adding
a new, separate check.  See
possibly-insecure-handling-of-tmp-files-in-maintainer-script.

This, like various other checks, should be extended to more than just
maintainer scripts, which requires some additional infrastruture work on
the lintian script checking.

-- 
Russ Allbery ([email protected])               <http://www.eyrie.org/~eagle/>

Message #15 received at [email protected] (full text, mbox, reply):

From: Russ Allbery <[email protected]>

To: [email protected]

Cc: [email protected]

Subject: tagging 495705, retitle 495705 to [checks/scripts] improvements to insecure /tmp checks

Date: Tue, 30 Dec 2008 23:32:46 -0800

# Automatically generated email from bts, devscripts version 2.10.35
# There are some good ideas here, but it's not a patch
tags 495705 - patch
retitle 495705 [checks/scripts] improvements to insecure /tmp checks

Message #24 received at [email protected] (full text, mbox, reply):

From: Russ Allbery <[email protected]>

To: [email protected]

Cc: [email protected], [email protected]

Subject: tagging 495705

Date: Tue, 30 Dec 2008 23:40:34 -0800

# Automatically generated email from bts, devscripts version 2.10.35
# Also not a security bug in Lintian
tags 495705 - security

Send a report that this bug log contains spam.