Bug 219279 - CVE-2006-6698 GConfd uses non-unique directory name in /tmp leading to local DoS
Summary: CVE-2006-6698 GConfd uses non-unique directory name in /tmp leading to local DoS
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: GConf2
Version: 4.4
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
: ---
Assignee: Ray Strode [halfline]
QA Contact:
URL:
Whiteboard: source=redhat;reported=2006-12-12;imp...
Depends On:
Blocks: CVE-2006-6698 219281
TreeView+ depends on / blocked
 
Reported: 2006-12-12 13:13 UTC by Lubomir Kundrak
Modified: 2007-11-17 01:14 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2007-06-21 18:04:32 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
GNOME Bugzilla 141138 0 None None None Never
GNOME Bugzilla 167030 0 None None None Never

Description Lubomir Kundrak 2006-12-12 13:13:03 UTC
Description of problem:

GConf uses the directory /tmp/gconfd-$LOGNAME for storing a lock file (and
possibly some other stuff -- I do not know, I know nearly nothing about GConf)
even if GCONF_GLOBAL_LOCKS environment is not set. As the /tmp directory is
sticky, it is possible for any user to create the directory with this name prior
to first login of a new user, effectively preventing it from using GConf
clients. The impact of this is quite serious, as the user can't use most of
Gnome, Evolution, etc. and it's quite hard for a non-technican user to work it
around.

Additionaly, I think any temporary directory and file should disappear when
application terminates. It is obvious that it is not a good practice not to do so.

Version-Release number of selected component (if applicable):

At least FC5 and FC6's GConf.

How reproducible:

Before user logs in/launches GConfd for the first time. Some systems erase /tmp
at each startup or use memory-based filesystem for it. In that case the problem
is reproducible after each startup.

Steps to Reproduce:

This migh be obvious enough
while (true); do touch /tmp/gconfd-$(tail -n1 /etc/passwd |awk -F: '{print
$1}'); done

Comment 1 Lubomir Kundrak 2006-12-22 13:18:20 UTC
This corresponds to following Gnome bugzilla entries:
http://bugzilla.gnome.org/show_bug.cgi?id=167030
http://bugzilla.gnome.org/show_bug.cgi?id=141138

Comment 2 Lubomir Kundrak 2007-01-02 09:24:58 UTC
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=404743

Comment 3 Ray Strode [halfline] 2007-06-21 18:04:12 UTC
Closing this bug WONTFIX.

See the explanation in bug 219281 for more details.




Note You need to log in before you can comment on or make changes to this bug.