Bug 460642 (CVE-2008-5007)

The lazarus package, as shipped within the Fedora releases of 9 and 10,
is prone to symlink attacks (various files).

Affected files and relevant parts of the code for each of them:

1, /usr/lib/lazarus/tools/convert_po_file_to_utf-8.sh

     15     iconv --from-code=$OldCharSet --to-code=UTF-8 $POFile > $POFile.tmp
     16     cat $POFile.tmp | sed -e 's/\(^".* charset\)='$OldCharSet'/\1=UTF-8/' > $POFile
     17     rm $POFile.tmp


2, /usr/lib/lazarus/tools/install/build_fpc_snaphot_rpm.sh

     54 # create a temporary copy of the fpc sources to patch it
     55 TmpDir=/tmp/`whoami`/fpc
     56 rm -rf $TmpDir

(And all occurences)


3, /usr/lib/lazarus/tools/install/check_fpc_dependencies.sh

     10 echo Testing fpc ...
     11 TmpDir=/tmp/fpc
     12 rm -rf $TmpDir
     13 mkdir -p $TmpDir


4, /usr/lib/lazarus/tools/install/create_fpc_deb.sh

 
     87 # create a temporary copy of the fpc sources to patch it
     88 
     89 TmpDir=/tmp/fpc_patchdir
     90 if [ "$WithTempDir" = "yes" ]; then
     91   if [ -d $TmpDir ]; then
     92     rm -rf $TmpDir/*
     93     rm -r $TmpDir
     94   fi
     95   mkdir -p $TmpDir


5, /usr/lib/lazarus/tools/install/create_fpc_export_tgz.sh

     23 if [ "x$Download" = "xyes" ]; then
     24   echo "downloading fpc svn ..."
     25   cd /tmp
     26   rm -rf /tmp/fpc
     27   svn export http://svn.freepascal.org/svn/fpc/trunk fpc
     28   cd -
     29 else
     30   echo "extracting fpc from local svn ..."
     31   rm -rf /tmp/fpc
     32   svn export $SourceDir /tmp/fpc
     33 fi
     34 
     35 cd /tmp
     36 echo "packing ..."
     37 tar cvzf /tmp/fpc.tgz fpc
     38 cd -
     39 mv /tmp/fpc.tgz $OutputFile
     40 rm -rf /tmp/fpc
     41 
     42 # end.
     43 

6, /usr/lib/lazarus/tools/install/create_fpc_rpm.sh

     53 # create a temporary copy of the fpc sources to patch it
     54 TmpDir=/tmp/fpc_patchdir
     55 if [ "$WithTempDir" = "yes" ]; then
     56   if [ -d $TmpDir ]; then
     57     rm -rf $TmpDir/*
     58     rm -r $TmpDir
     59   fi
     60   mkdir -p $TmpDir

7,   /usr/lib/lazarus/tools/install/create_fpc-src_rpm.sh

     56 # copy custom rpm scripts
     57 cp smart_strip.sh /tmp/smart_strip.sh
     58 chmod a+x /tmp/smart_strip.sh
     59 cp do_nothing.sh /tmp/do_nothing.sh
     60 chmod a+x /tmp/do_nothing.sh

8,   /usr/lib/lazarus/tools/install/create_fpc_tgz_from_local_dir.sh

     35 TmpBaseDir=/tmp
     36 TmpDir=$TmpBaseDir/fpc
     37 
     38 rm -rf $TmpDir

9,  /usr/lib/lazarus/tools/install/create_lazarus_export_tgz.sh 

     20 if [ "x$Download" = "xyes" ]; then
     21   echo "downloading lazarus svn ..."
     22   cd /tmp
     23   rm -rf /tmp/lazarus
     24   svn export http://svn.freepascal.org/svn/lazarus/trunk lazarus
     25   cd -
     26 else
     27   echo "extracting lazarus from local svn ..."
     28   SourceDir=$(pwd | sed -e 's#lazarus[_0-9]*/tools.*$#lazarus#')
     29   rm -rf /tmp/lazarus
     30   svn export $SourceDir /tmp/lazarus
     31 fi

     33 # add ide/revision.inc
     34 Revision=$(svnversion /tmp/lazarus)
     35 echo "const RevisionStr = '$Revision';" > /tmp/lazarus/ide/revision.inc

     37 cd /tmp
     38 echo "packing ..."
     39 tar cvzf lazarus.tgz lazarus
     40 cd -
     41 mv /tmp/lazarus.tgz $OutputFile
     42 rm -rf /tmp/lazarus

     (More example to be added in next comments).

Description:

A malicious user could precreate a symlink to the some name, of the
'hardcoded' files in /tmp directory. Subsequent installation of the
lazarus package would allow him to destroy / truncate the target of
the symlink to zero size.

Affected lazarus versions:

This issue affects the versions of the lazarus package, as shipped with
Fedora releases of 9 and 10.