Bug 1060907 (CVE-2014-1876) - CVE-2014-1876 OpenJDK: insecure temporary file use in unpack200 (Libraries, 8033618)
Summary: CVE-2014-1876 OpenJDK: insecure temporary file use in unpack200 (Libraries, 8...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-1876
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1060911 1082776
TreeView+ depends on / blocked
 
Reported: 2014-02-03 21:43 UTC by Vincent Danen
Modified: 2019-09-29 13:13 UTC (History)
10 users (show)

Fixed In Version: icedtea 1.13.3, icedtea 2.4.7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-06-10 14:09:09 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:0406 normal SHIPPED_LIVE Critical: java-1.7.0-openjdk security update 2014-04-16 15:24:01 UTC
Debian BTS 737562 None None None Never
Red Hat Product Errata RHSA-2014:0407 normal SHIPPED_LIVE Important: java-1.7.0-openjdk security update 2014-04-16 15:23:49 UTC
Red Hat Product Errata RHSA-2014:0408 normal SHIPPED_LIVE Important: java-1.6.0-openjdk security and bug fix update 2014-04-16 15:34:59 UTC
Red Hat Product Errata RHSA-2014:0412 normal SHIPPED_LIVE Critical: java-1.7.0-oracle security update 2014-04-17 13:28:34 UTC
Red Hat Product Errata RHSA-2014:0413 normal SHIPPED_LIVE Critical: java-1.7.0-oracle security update 2017-12-15 19:38:34 UTC
Red Hat Product Errata RHSA-2014:0414 normal SHIPPED_LIVE Important: java-1.6.0-sun security update 2017-12-15 19:38:49 UTC
Red Hat Product Errata RHSA-2014:0486 normal SHIPPED_LIVE Critical: java-1.7.0-ibm security update 2014-05-13 23:47:47 UTC
Red Hat Product Errata RHSA-2014:0508 normal SHIPPED_LIVE Critical: java-1.6.0-ibm security update 2014-05-15 21:28:29 UTC
Red Hat Product Errata RHSA-2014:0509 normal SHIPPED_LIVE Important: java-1.5.0-ibm security update 2014-05-15 22:19:35 UTC
Red Hat Product Errata RHSA-2014:0675 normal SHIPPED_LIVE Critical: java-1.7.0-openjdk security update 2014-06-10 16:13:04 UTC
Red Hat Product Errata RHSA-2014:0685 normal SHIPPED_LIVE Important: java-1.6.0-openjdk security update 2014-06-10 16:34:29 UTC
Red Hat Product Errata RHSA-2014:0705 normal SHIPPED_LIVE Critical: java-1.7.1-ibm security update 2014-06-10 17:07:11 UTC
Red Hat Product Errata RHSA-2014:0982 normal SHIPPED_LIVE Low: Red Hat Network Satellite server IBM Java Runtime security update 2014-07-29 19:40:11 UTC

Description Vincent Danen 2014-02-03 21:43:28 UTC
Jakub Wilk reported in a Debian bug report [1] that the unpack200 program included in OpenJDK did not properly handle the logfile properly.  If the the log file was unable to be opened, it would create /tmp/unpack.log instead as the fallback, but do so in an insecure manner, as shown in unpack.cpp (the below is from OpenJDK 6):

4732 void unpacker::redirect_stdio() {
...
4757 #else
4758     sprintf(tmpdir,"/tmp");
4759     sprintf(log_file_name, "/tmp/unpack.log");
4760 #endif
4761     if ((errstrm = fopen(log_file_name, "a+")) != NULL) {
4762       log_file = errstrm_name = saveStr(log_file_name);
4763       return ;
4764     }
4765
4766     char *tname = tempnam(tmpdir,"#upkg");
4767     sprintf(log_file_name, "%s", tname);
4768     if ((errstrm = fopen(log_file_name, "a+")) != NULL) {
4769       log_file = errstrm_name = saveStr(log_file_name);
4770       return ;
4771     }

The same exists in OpenJDK 7 and 8.

This could allow a malicious local attacker to conduct local attacks, such as symlink attacks, where a file could be overwritten if the user running unpack200 had write permissions.

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737562

Comment 1 Vincent Danen 2014-02-08 00:58:19 UTC
MITRE assigned CVE-2014-1876 to this issue:

http://openwall.com/lists/oss-security/2014/02/08/1

Comment 2 Tomas Hoger 2014-02-28 12:35:09 UTC
(In reply to Vincent Danen from comment #0)
> If the the log file was unable to be opened, it would create /tmp/unpack.log
> instead as the fallback, but do so in an insecure manner

There are actually multiple fallbacks.  Following is tried when unpacking, proceeding to the next if the current one fails:

- open log file that was specified on the command line using -l / --log-file option
- open /tmp/unpack.log
- use tmpnam() to generate unique filename with the pattern /tmp/#upkgXXXXXX, this file is also opened insecurely
- open /dev/null
- use stderr for logging

This has a rather limited impact.  Issue can only be triggered when user runs unpack200 with -l / / --log-file option with argument being a file that can not be created by unpack200 (e.g. file in a directory that does not exist or is not writable to the user running it, or file that already exists and can not be overwritten).

This issue currently remains unfixed upstream (it still exists in jdk9 hg).  The easy fix is to remove fallback to /tmp/unpack.log.  Fallback to tmpnam() generated temporary file should either be removed too, or replaced by safer variant (e.g. using mkstemp()).

Issue exists in all currently supported versions of OpenJDK, Oracle/Sun JDK, and IBM JDK shipped as part of Red Hat Enterprise Linux.

Comment 4 Tomas Hoger 2014-04-15 20:38:03 UTC
Fixed now in Oracle Java SE 5.0u75, 6u75, 7u55 and 8u5 via Oracle Critical Patch Update Advisory - April 2014.

External References:

http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html#AppendixJAVA

Comment 6 errata-xmlrpc 2014-04-16 11:24:18 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2014:0407 https://rhn.redhat.com/errata/RHSA-2014-0407.html

Comment 7 errata-xmlrpc 2014-04-16 11:31:46 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2014:0406 https://rhn.redhat.com/errata/RHSA-2014-0406.html

Comment 8 errata-xmlrpc 2014-04-16 11:35:30 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2014:0408 https://rhn.redhat.com/errata/RHSA-2014-0408.html

Comment 9 Tomas Hoger 2014-04-16 12:25:02 UTC
(In reply to Tomas Hoger from comment #2)
> The easy fix is to remove fallback to /tmp/unpack.log.  Fallback to tmpnam()
> generated temporary file should either be removed too, or replaced by safer
> variant (e.g. using mkstemp()).

Upstream fix implements this proposal and removes fall back to hard-coded log file name, or logging to file with name generated using tmpnam():

http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/ce81e69d561d

Comment 10 errata-xmlrpc 2014-04-17 09:30:59 UTC
This issue has been addressed in following products:

  Oracle Java for Red Hat Enterprise Linux 6
  Oracle Java for Red Hat Enterprise Linux 5

Via RHSA-2014:0413 https://rhn.redhat.com/errata/RHSA-2014-0413.html

Comment 11 errata-xmlrpc 2014-04-17 09:33:59 UTC
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 6
  Supplementary for Red Hat Enterprise Linux 5

Via RHSA-2014:0412 https://rhn.redhat.com/errata/RHSA-2014-0412.html

Comment 12 Stefan Cornelius 2014-04-17 10:33:29 UTC
OpenJDK upstream commit:
http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/ce81e69d561d

Comment 13 errata-xmlrpc 2014-04-17 11:45:45 UTC
This issue has been addressed in following products:

  Oracle Java for Red Hat Enterprise Linux 6
  Oracle Java for Red Hat Enterprise Linux 5

Via RHSA-2014:0414 https://rhn.redhat.com/errata/RHSA-2014-0414.html

Comment 14 errata-xmlrpc 2014-05-13 19:48:18 UTC
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2014:0486 https://rhn.redhat.com/errata/RHSA-2014-0486.html

Comment 15 errata-xmlrpc 2014-05-15 17:29:40 UTC
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2014:0508 https://rhn.redhat.com/errata/RHSA-2014-0508.html

Comment 16 errata-xmlrpc 2014-05-15 18:22:39 UTC
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 5
  Supplementary for Red Hat Enterprise Linux 6

Via RHSA-2014:0509 https://rhn.redhat.com/errata/RHSA-2014-0509.html

Comment 17 errata-xmlrpc 2014-06-10 12:17:58 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 7

Via RHSA-2014:0675 https://rhn.redhat.com/errata/RHSA-2014-0675.html

Comment 18 errata-xmlrpc 2014-06-10 12:39:01 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 7

Via RHSA-2014:0685 https://rhn.redhat.com/errata/RHSA-2014-0685.html

Comment 19 errata-xmlrpc 2014-06-10 13:14:16 UTC
This issue has been addressed in following products:

  Supplementary for Red Hat Enterprise Linux 7

Via RHSA-2014:0705 https://rhn.redhat.com/errata/RHSA-2014-0705.html

Comment 20 errata-xmlrpc 2014-07-29 15:42:19 UTC
This issue has been addressed in following products:

  Red Hat Network Satellite Server v 5.4
  Red Hat Network Satellite Server v 5.5
  Red Hat Satellite Server v 5.6

Via RHSA-2014:0982 https://rhn.redhat.com/errata/RHSA-2014-0982.html


Note You need to log in before you can comment on or make changes to this bug.