Red Hat Bugzilla – Bug 444535
CVE-2008-1103 Blender insecure temporary file usage
Last modified: 2016-06-10 16:31:31 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2008-1103 to the following vulnerability:
Multiple unspecified vulnerabilities in Blender have unknown impact and attack vectors, related to "temporary file issues."
Noted in SuSE advisory:
Since we do not think that Blender is not used in security critical settings
with network input data we fixed this problem only for future products.
The temporary file issue is not currently fixed in SuSE packages.
Further details regarding this are covered in Ubuntu and Debian bug reports:
Problematic files in /tmp are:
- /tmp/0001.jpg, /tmp/0002.jpg, ...
First issue seems to have been fixed in the past in Debian packages, first using
O_EXCL in open(), later replaced with move of temporary directory to user's
$HOME. Debian patches attached in following comments.
Created attachment 304747 [details]
First Debian patch
Created attachment 304748 [details]
Second Debian patch
Moves quit.blend to $HOME, first occurred in:
I have checkin blender-2.45rc3 on rawhide. On this version I could apply the
first patch, but the second one failed. Perhaps anyone may have a look on it,
bacause I have no idea how I should modified this patch for the next blender
Jochen, I believe either one of the Debian patches should be sufficient to
address quit.blend issue. Does it also address the other issue with 000X.jpg?
Maybe, Unfortunately, I'm unsure and have contact the updatream.
I think, I should build a package for rawhinde with the first debian patch and
wait on the response of the upstream.
Second issue -- /tmp/000X.jpg -- still affects new blender-2.45-14 packages,
confirmed with blender-2.45-14.fc8.
Secunia assigned CVE id CVE-2008-1103 to the Multiple Temporary File Security
Issues and the description is now available here:
[ ... ]
The security issues are caused due to Blender handling temporary files in
an insecure manner (e.g. creating "/tmp/quit.blend" when quitting Blender,
using easy to guess file names and insecure file permissions to store
temporary render frames, and insecure file permission when auto saving
files). This can be exploited to e.g. conduct symlink attacks and overwrite
arbitrary files with the permissions of the user running Blender or
disclose potentially sensitive information.
Besides the two issue already described in the comment #1, there is the third
issue covered by this CVE id:
- insecure file permission for auto saved files
There is still an issue with regards to the /tmp/000x.jpg files being created which could cause symlinks attacks. Is anyone addressing this or know if it has been addressed?
I'm to get a anser of the bf-commiter mailing list.
Sorry, I would write: 'I'm trying to get an answer on the bf-commiter mailing list'
I have got the following anser:
"People can change the temp path in user settings if they disagree with the default value."
But I think this is not the expected solution, so I have poke again on bf-commiters.
Thanks for chasing this Jochen. I agree with you, I don't think it is great default behaviour and default should be somewhere more sane.
I also opened a bug on the blender bug tracker http://projects.blender.org/tracker/index.php?func=detail&aid=18174&group_id=9&atid=125
Reporter changed to email@example.com by request of Jay Turner.
(In reply to comment #16)
> Thanks for chasing this Jochen. I agree with you, I don't think it is great
> default behaviour and default should be somewhere more sane.
> I also opened a bug on the blender bug tracker
Was this second issue solved yet? (I doesn't seem to be able to access
above ticket, as getting "Invalid Artifact ID").
Im not sure if this issue was ever solved. Don't remember getting an update, and I am getting the same error as you. I guess it doesn't help either that search is disabled...