Bug 1024746 (CVE-2013-4472)

Summary:	CVE-2013-4472 poppler, xpdf: insecure temporary file
Product:	[Other] Security Response	Reporter:	Ratul Gupta <ratulg>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	jkurik, jrusnack, mkasik, pfrields, rdieter, tcallawa
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-10-31 06:41:58 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1024765, 1024766, 1024767
Bug Blocks:	1025135

Description Ratul Gupta 2013-10-30 11:01:39 UTC

Poppler and Xpdf, both seems to be affected by a vulnerability of use of insecure temporary file for non-UNIX OS's. An attacker with local access could potentially exploit this issue to perform symlink attacks, overwriting arbitrary files in the context of the affected application.

The issue is still to be fixed in both poppler and xpdf.

References:
http://seclists.org/oss-sec/2013/q4/181

Comment 1 Ratul Gupta 2013-10-30 11:12:11 UTC

GBool openTempFile(GooString **name, FILE **f, const char *mode) {
#if defined(_WIN32)
  //---------- Win32 ----------
  char *tempDir;
  GooString *s, *s2;
  FILE *f2;
  int t, i;

  // this has the standard race condition problem, but I haven't found
  // a better way to generate temp file names with extensions on
  // Windows
  if ((tempDir = getenv("TEMP"))) {
    s = new GooString(tempDir);
    s->append('\\');
  } else {
    s = new GooString();
  }
  s->appendf("x_{0:d}_{1:d}_",
    (int)GetCurrentProcessId(), (int)GetCurrentThreadId());
  t = (int)time(NULL);
  for (i = 0; i < 1000; ++i) {
    s2 = s->copy()->appendf("{0:d}", t + i);
    if (!(f2 = fopen(s2->getCString(), "r"))) {
      if (!(f2 = fopen(s2->getCString(), mode))) {
delete s2;
delete s;
        return gFalse;
      }
      *name = s2;
      *f = f2;
      delete s;
      return gTrue;
    }
    fclose(f2);
    delete s2;
  }
  delete s;
  return gFalse;
#elif defined(VMS) || defined(__EMX__) || defined(ACORN) || defined(MACOS)
  //---------- non-Unix ----------
  char *s;

  // There is a security hole here: an attacker can create a symlink
  // with this file name after the tmpnam call and before the fopen
  // call.  I will happily accept fixes to this function for non-Unix
  // OSs.
  if (!(s = tmpnam(NULL))) {
    return gFalse;
  }
  *name = new GooString(s);
  if (!(*f = fopen((*name)->getCString(), mode))) {
    delete (*name);
    *name = NULL;
    return gFalse;
  }
  return gTrue;

Comment 2 Ratul Gupta 2013-10-30 11:41:00 UTC

Created xpdf tracking bugs for this issue:

Affects: fedora-all [bug 1024766]
Affects: epel-all [bug 1024767]

Comment 3 Ratul Gupta 2013-10-30 11:41:14 UTC

Created poppler tracking bugs for this issue:

Affects: fedora-all [bug 1024765]

Comment 4 Marek Kašík 2013-10-30 14:04:43 UTC

(In reply to Ratul Gupta from comment #3)
> Created poppler tracking bugs for this issue:
> 
> Affects: fedora-all [bug 1024765]

Hi,

do we really need to fix this in fedora's poppler? From my understaning, it should affect just non-UNIX OSs.

Regards

Marek

Comment 5 Huzaifa S. Sidhpurwala 2013-10-31 06:41:13 UTC

Statement:

Not Vulnerable. This issue does not affect the version of poppler as shipped with Red Hat Enterprise Linux 5 and 6.

Comment 6 Huzaifa S. Sidhpurwala 2013-10-31 06:41:58 UTC

This issue does not affect the version of poppler in Linux/Unix.