Red Hat Bugzilla – Full Text Bug Listing
|Summary:||CVE-2008-1103 Blender insecure temporary file usage|
|Product:||[Other] Security Response||Reporter:||Red Hat Product Security <security-response-team>|
|Component:||vulnerability||Assignee:||Red Hat Product Security <security-response-team>|
|Status:||CLOSED NOTABUG||QA Contact:|
|Version:||unspecified||CC:||jlieskov, jochen, stefan|
|Fixed In Version:||Doc Type:||Bug Fix|
|Doc Text:||Story Points:||---|
|Last Closed:||2016-06-10 16:31:31 EDT||Type:||---|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
Description Lubomir Kundrak 2008-04-28 18:16:05 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-1103 to the following vulnerability: Multiple unspecified vulnerabilities in Blender have unknown impact and attack vectors, related to "temporary file issues." References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00011.html http://www.securityfocus.com/bid/28936
Comment 1 Tomas Hoger 2008-05-07 05:46:22 EDT
Noted in SuSE advisory: Since we do not think that Blender is not used in security critical settings with network input data we fixed this problem only for future products. The temporary file issue is not currently fixed in SuSE packages. Further details regarding this are covered in Ubuntu and Debian bug reports: https://bugs.launchpad.net/ubuntu/+source/blender/+bug/6671 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=298167 Problematic files in /tmp are: - /tmp/quit.blend - /tmp/0001.jpg, /tmp/0002.jpg, ... First issue seems to have been fixed in the past in Debian packages, first using O_EXCL in open(), later replaced with move of temporary directory to user's $HOME. Debian patches attached in following comments.
Comment 2 Tomas Hoger 2008-05-07 05:48:48 EDT
Created attachment 304747 [details] First Debian patch Occurred in: http://packages.debian.org/changelogs/pool/main/b/blender/blender_2.45-5/changelog#versionversion2.36-1
Comment 3 Tomas Hoger 2008-05-07 05:50:30 EDT
Created attachment 304748 [details] Second Debian patch Moves quit.blend to $HOME, first occurred in: http://packages.debian.org/changelogs/pool/main/b/blender/blender_2.45-5/changelog#versionversion2.37a-1
Comment 4 Jochen Schmitt 2008-05-07 12:14:36 EDT
I have checkin blender-2.45rc3 on rawhide. On this version I could apply the first patch, but the second one failed. Perhaps anyone may have a look on it, bacause I have no idea how I should modified this patch for the next blender release.
Comment 5 Tomas Hoger 2008-05-07 12:33:59 EDT
Jochen, I believe either one of the Debian patches should be sufficient to address quit.blend issue. Does it also address the other issue with 000X.jpg?
Comment 6 Jochen Schmitt 2008-05-07 12:37:05 EDT
Maybe, Unfortunately, I'm unsure and have contact the updatream. I think, I should build a package for rawhinde with the first debian patch and wait on the response of the upstream.
Comment 8 Tomas Hoger 2008-05-07 13:51:56 EDT
Second issue -- /tmp/000X.jpg -- still affects new blender-2.45-14 packages, confirmed with blender-2.45-14.fc8.
Comment 11 Tomas Hoger 2008-06-09 11:47:28 EDT
Secunia assigned CVE id CVE-2008-1103 to the Multiple Temporary File Security Issues and the description is now available here: http://secunia.com/advisories/29842/ [ ... ] The security issues are caused due to Blender handling temporary files in an insecure manner (e.g. creating "/tmp/quit.blend" when quitting Blender, using easy to guess file names and insecure file permissions to store temporary render frames, and insecure file permission when auto saving files). This can be exploited to e.g. conduct symlink attacks and overwrite arbitrary files with the permissions of the user running Blender or disclose potentially sensitive information. Besides the two issue already described in the comment #1, there is the third issue covered by this CVE id: - insecure file permission for auto saved files
Comment 12 Stefan Lesicnik 2009-01-15 10:54:56 EST
There is still an issue with regards to the /tmp/000x.jpg files being created which could cause symlinks attacks. Is anyone addressing this or know if it has been addressed?
Comment 13 Jochen Schmitt 2009-01-15 14:09:54 EST
I'm to get a anser of the bf-commiter mailing list.
Comment 14 Jochen Schmitt 2009-01-15 14:11:30 EST
Sorry, I would write: 'I'm trying to get an answer on the bf-commiter mailing list'
Comment 15 Jochen Schmitt 2009-01-15 14:17:53 EST
I have got the following anser: "People can change the temp path in user settings if they disagree with the default value." But I think this is not the expected solution, so I have poke again on bf-commiters.
Comment 16 Stefan Lesicnik 2009-01-15 14:26:56 EST
Thanks for chasing this Jochen. I agree with you, I don't think it is great default behaviour and default should be somewhere more sane. I also opened a bug on the blender bug tracker http://projects.blender.org/tracker/index.php?func=detail&aid=18174&group_id=9&atid=125
Comment 17 Red Hat Bugzilla 2009-10-23 15:05:03 EDT
Reporter changed to firstname.lastname@example.org by request of Jay Turner.
Comment 18 Jan Lieskovsky 2010-06-05 14:24:57 EDT
Stefan, Jochen, (In reply to comment #16) > Thanks for chasing this Jochen. I agree with you, I don't think it is great > default behaviour and default should be somewhere more sane. > > I also opened a bug on the blender bug tracker > http://projects.blender.org/tracker/index.php?func=detail&aid=18174&group_id=9&atid=125 Was this second issue solved yet? (I doesn't seem to be able to access above ticket, as getting "Invalid Artifact ID"). Thanks, Jan.
Comment 19 Stefan Lesicnik 2010-06-07 07:48:03 EDT
Hi, Im not sure if this issue was ever solved. Don't remember getting an update, and I am getting the same error as you. I guess it doesn't help either that search is disabled... Stefan