Bug 444535 (CVE-2008-1103)

Summary: CVE-2008-1103 Blender insecure temporary file usage
Product: [Other] Security Response Reporter: Red Hat Product Security <security-response-team>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: jlieskov, jochen, stefan
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1103
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-06-10 16:31:31 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Description Flags
First Debian patch
Second Debian patch none

Description Lubomir Kundrak 2008-04-28 18:16:05 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-1103 to the following vulnerability:

Multiple unspecified vulnerabilities in Blender have unknown impact and attack vectors, related to "temporary file issues."


Comment 1 Tomas Hoger 2008-05-07 05:46:22 EDT
Noted in SuSE advisory:

  Since we do not think that Blender is not used in security critical settings
  with network input data we fixed this problem only for future products.

The temporary file issue is not currently fixed in SuSE packages.

Further details regarding this are covered in Ubuntu and Debian bug reports:


Problematic files in /tmp are:
- /tmp/quit.blend
- /tmp/0001.jpg, /tmp/0002.jpg, ...

First issue seems to have been fixed in the past in Debian packages, first using
O_EXCL in open(), later replaced with move of temporary directory to user's
$HOME.  Debian patches attached in following comments.
Comment 3 Tomas Hoger 2008-05-07 05:50:30 EDT
Created attachment 304748 [details]
Second Debian patch

Moves quit.blend to $HOME, first occurred in:

Comment 4 Jochen Schmitt 2008-05-07 12:14:36 EDT
I have checkin blender-2.45rc3 on rawhide. On this version I could apply the
first patch, but the second one failed. Perhaps anyone may have a look on it,
bacause I have no idea how I should modified this patch for the next blender
Comment 5 Tomas Hoger 2008-05-07 12:33:59 EDT
Jochen, I believe either one of the Debian patches should be sufficient to
address quit.blend issue.  Does it also address the other issue with 000X.jpg?
Comment 6 Jochen Schmitt 2008-05-07 12:37:05 EDT
Maybe, Unfortunately, I'm unsure and have contact the updatream.

I think, I should build a package for rawhinde with the first debian patch and
wait on the response of the upstream.
Comment 8 Tomas Hoger 2008-05-07 13:51:56 EDT
Second issue -- /tmp/000X.jpg -- still affects new blender-2.45-14 packages,
confirmed with blender-2.45-14.fc8.
Comment 11 Tomas Hoger 2008-06-09 11:47:28 EDT
Secunia assigned CVE id CVE-2008-1103 to the Multiple Temporary File Security
Issues and the description is now available here:


  [ ... ]

  The security issues are caused due to Blender handling temporary files in
  an insecure manner (e.g. creating "/tmp/quit.blend" when quitting Blender,
  using easy to guess file names and insecure file permissions to store
  temporary render frames, and insecure file permission when auto saving
  files). This can be exploited to e.g. conduct symlink attacks and overwrite
  arbitrary files with the permissions of the user running Blender or
  disclose potentially sensitive information.

Besides the two issue already described in the comment #1, there is the third
issue covered by this CVE id:

- insecure file permission for auto saved files
Comment 12 Stefan Lesicnik 2009-01-15 10:54:56 EST
There is still an issue with regards to the /tmp/000x.jpg files being created which could cause symlinks attacks. Is anyone addressing this or know if it has been addressed?
Comment 13 Jochen Schmitt 2009-01-15 14:09:54 EST
I'm to get a anser of the bf-commiter mailing list.
Comment 14 Jochen Schmitt 2009-01-15 14:11:30 EST
Sorry, I would write: 'I'm trying to get an answer on the bf-commiter mailing list'
Comment 15 Jochen Schmitt 2009-01-15 14:17:53 EST
I have got the following anser:

"People can change the temp path in user settings if they disagree with the default value."

But I think this is not the expected solution, so I have poke again on bf-commiters.
Comment 16 Stefan Lesicnik 2009-01-15 14:26:56 EST
Thanks for chasing this Jochen. I agree with you, I don't think it is great default behaviour and default should be somewhere more sane.

I also opened a bug on the blender bug tracker http://projects.blender.org/tracker/index.php?func=detail&aid=18174&group_id=9&atid=125
Comment 17 Red Hat Bugzilla 2009-10-23 15:05:03 EDT
Reporter changed to security-response-team@redhat.com by request of Jay Turner.
Comment 18 Jan Lieskovsky 2010-06-05 14:24:57 EDT
Stefan, Jochen,

(In reply to comment #16)
> Thanks for chasing this Jochen. I agree with you, I don't think it is great
> default behaviour and default should be somewhere more sane.
> I also opened a bug on the blender bug tracker
> http://projects.blender.org/tracker/index.php?func=detail&aid=18174&group_id=9&atid=125    

Was this second issue solved yet? (I doesn't seem to be able to access
above ticket, as getting "Invalid Artifact ID").

Thanks, Jan.
Comment 19 Stefan Lesicnik 2010-06-07 07:48:03 EDT

Im not sure if this issue was ever solved. Don't remember getting an update, and I am getting the same error as you.  I guess it doesn't help either that search is disabled...