Common Vulnerabilities and Exposures assigned an identifier CVE-2008-1103 to the following vulnerability: Multiple unspecified vulnerabilities in Blender have unknown impact and attack vectors, related to "temporary file issues." References: http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00011.html http://www.securityfocus.com/bid/28936
Noted in SuSE advisory: Since we do not think that Blender is not used in security critical settings with network input data we fixed this problem only for future products. The temporary file issue is not currently fixed in SuSE packages. Further details regarding this are covered in Ubuntu and Debian bug reports: https://bugs.launchpad.net/ubuntu/+source/blender/+bug/6671 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=298167 Problematic files in /tmp are: - /tmp/quit.blend - /tmp/0001.jpg, /tmp/0002.jpg, ... First issue seems to have been fixed in the past in Debian packages, first using O_EXCL in open(), later replaced with move of temporary directory to user's $HOME. Debian patches attached in following comments.
Created attachment 304747 [details] First Debian patch Occurred in: http://packages.debian.org/changelogs/pool/main/b/blender/blender_2.45-5/changelog#versionversion2.36-1
Created attachment 304748 [details] Second Debian patch Moves quit.blend to $HOME, first occurred in: http://packages.debian.org/changelogs/pool/main/b/blender/blender_2.45-5/changelog#versionversion2.37a-1
I have checkin blender-2.45rc3 on rawhide. On this version I could apply the first patch, but the second one failed. Perhaps anyone may have a look on it, bacause I have no idea how I should modified this patch for the next blender release.
Jochen, I believe either one of the Debian patches should be sufficient to address quit.blend issue. Does it also address the other issue with 000X.jpg?
Maybe, Unfortunately, I'm unsure and have contact the updatream. I think, I should build a package for rawhinde with the first debian patch and wait on the response of the upstream.
Second issue -- /tmp/000X.jpg -- still affects new blender-2.45-14 packages, confirmed with blender-2.45-14.fc8.
Secunia assigned CVE id CVE-2008-1103 to the Multiple Temporary File Security Issues and the description is now available here: http://secunia.com/advisories/29842/ [ ... ] The security issues are caused due to Blender handling temporary files in an insecure manner (e.g. creating "/tmp/quit.blend" when quitting Blender, using easy to guess file names and insecure file permissions to store temporary render frames, and insecure file permission when auto saving files). This can be exploited to e.g. conduct symlink attacks and overwrite arbitrary files with the permissions of the user running Blender or disclose potentially sensitive information. Besides the two issue already described in the comment #1, there is the third issue covered by this CVE id: - insecure file permission for auto saved files
There is still an issue with regards to the /tmp/000x.jpg files being created which could cause symlinks attacks. Is anyone addressing this or know if it has been addressed?
I'm to get a anser of the bf-commiter mailing list.
Sorry, I would write: 'I'm trying to get an answer on the bf-commiter mailing list'
I have got the following anser: "People can change the temp path in user settings if they disagree with the default value." But I think this is not the expected solution, so I have poke again on bf-commiters.
Thanks for chasing this Jochen. I agree with you, I don't think it is great default behaviour and default should be somewhere more sane. I also opened a bug on the blender bug tracker http://projects.blender.org/tracker/index.php?func=detail&aid=18174&group_id=9&atid=125
Reporter changed to security-response-team by request of Jay Turner.
Stefan, Jochen, (In reply to comment #16) > Thanks for chasing this Jochen. I agree with you, I don't think it is great > default behaviour and default should be somewhere more sane. > > I also opened a bug on the blender bug tracker > http://projects.blender.org/tracker/index.php?func=detail&aid=18174&group_id=9&atid=125 Was this second issue solved yet? (I doesn't seem to be able to access above ticket, as getting "Invalid Artifact ID"). Thanks, Jan.
Hi, Im not sure if this issue was ever solved. Don't remember getting an update, and I am getting the same error as you. I guess it doesn't help either that search is disabled... Stefan