Bug 460648 - crossfire-maps: Insecure auxiliary /tmp file usage (symlink attack possible)
crossfire-maps: Insecure auxiliary /tmp file usage (symlink attack possible)
Status: CLOSED WONTFIX
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
reported=20080828,public=20080824,sou...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-08-29 09:41 EDT by Jan Lieskovsky
Modified: 2010-03-22 11:42 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-03-22 11:42:55 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2008-08-29 09:41:40 EDT
The crossfire-maps package, as shipped within Fedora releases of 8, 9 and 10,
is prone to the symlink attack.

Affected file: /usr/share/crossfire/maps/Info/combine.pl

Relevant part of the code:

36:    system("ppmmake \\#000 $DEST_WIDTH $DEST_HEIGHT > /tmp/tmp.ppm");
40:    system("cp images/combine.ppm /tmp/tmp.ppm");
62:         system("pngtopnm images/world_$dx\_$dy.png | pnmscale -xysize $TILE_WIDTH $TILE_HEIGHT > /tmp/ppm.tmp");
65:         system("pnmpaste /tmp/ppm.tmp $sx $sy /tmp/tmp.ppm > /tmp/tmp.ppm1");
66:         unlink("/tmp/tmp.ppm");
67:         rename("/tmp/tmp.ppm1", "/tmp/tmp.ppm");
71:system("mv /tmp/tmp.ppm images/combine.ppm");

Description: 

A malicious user could precreate a symbolic link pointing to the file 
'/tmp/tmp.ppm'. Subsequent run of the crossfire command, would 
destroy / truncate the target of the symlink to zero size.

Affected versions:

This issue affects the versions of the crossfire-maps package, as shipped
within Fedora releases of 8, 9 and 10.

Note You need to log in before you can comment on or make changes to this bug.