Bug 855092 (CVE-2010-5105)
| Summary: | CVE-2010-5105 blender: Insecure temporary file use by creating file string in undo save quit Blender kernel routine | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Jan Lieskovsky <jlieskov> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | hobbes1069, jochen, jrusnack, kwizart, luigiwalser, mmcallis, promac |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-04-28 19:30:34 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 855093 | ||
| Bug Blocks: | |||
|
Description
Jan Lieskovsky
2012-09-06 16:29:43 UTC
This issue affects the versions of the blender package, as shipped with Fedora release of 16 and 17. Please schedule an update. -- This issue did NOT affect the versions of the blender package, as shipped with Fedora EPEL 5 and Fedora EPEL 6 (as they still contain the blender-2.49b-cve.patch patch). Created blender tracking bugs for this issue Affects: fedora-all [bug 855093] This was assigned CVE-2012-4410: http://www.openwall.com/lists/oss-security/2012/09/06/5 blender-2.63a-4.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report. blender-2.59-7.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report. blender-2.63a-8.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report. blender-2.63a-9.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report. The patch does not fix it in 2.63a-4.fc17. $ ln -s ~/foo.txt /tmp/quit.blend $ echo foo > ~/foo.txt $ file ~/foo.txt foo.txt: ASCII text $ blender connect failed: No such file or directory ndof: spacenavd not found Saved session recovery to /tmp/quit.blend Blender quit $ file ~/foo.txt foo.txt: Blender3D, saved as 32-bits little endian with version 2.63 Looking at the patch, it looks like open() will fail the first time because of the O_EXCL and the file exists, but then it gets rid of O_CREAT from the flags and tries again, and open() succeeds and it overwrites the file. Running through gdb it looks like this is what happens. If I rm ~/foo.txt and do it again, it won't create a new one, so I guess that's the only thing it's currently protecting against. I guess O_EXCL makes it fail the first time because of the symlink, and then it fails the next time because it doesn't exist and O_CREAT is gone. CVE ID changed from CVE-2012-4410 to CVE-2010-5105: http://www.openwall.com/lists/oss-security/2012/09/07/13 I have done a test with blender-2.69 and it's look like that the issue doesn't exists since this release. So I want to close this bug. Did you look at the code to see if something had been done to fix it? Last I checked (2.68 IIRC), nothing had. Is it possible you just have /proc/sys/fs/protected_symlinks [1][2] enabled in your kernel, which should mitigate this and basically just hide the problem? [1] - https://lists.debian.org/debian-devel-announce/2014/03/msg00004.html [2] - https://lwn.net/Articles/503660/ |